python/samba/upgradehelpers.py

   1 # Helpers for provision stuff
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
   3 #
   4 # Based on provision a Samba4 server by
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 """Helpers used for upgrading between different database formats."""
  23
  24 import os
  25 import re
  26 import shutil
  27 import samba
  28
  29 from samba import Ldb, version, ntacls
  30 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
  31 import ldb
  32 from samba.provision import (provision_paths_from_lp,
  33                             getpolicypath, set_gpos_acl, create_gpo_struct,
  34                             FILL_FULL, provision, ProvisioningError,
  35                             setsysvolacl, secretsdb_self_join)
  36 from samba.dcerpc import xattr, drsblobs
  37 from samba.dcerpc.misc import SEC_CHAN_BDC
  38 from samba.ndr import ndr_unpack
  39 from samba.samdb import SamDB
  40 from samba import _glue
  41 import tempfile
  42
  43 # All the ldb related to registry are commented because the path for them is
  44 # relative in the provisionPath object
  45 # And so opening them create a file in the current directory which is not what
  46 # we want
  47 # I still keep them commented because I plan soon to make more cleaner
  48 ERROR =     -1
  49 SIMPLE =     0x00
  50 CHANGE =     0x01
  51 CHANGESD =     0x02
  52 GUESS =     0x04
  53 PROVISION =    0x08
  54 CHANGEALL =    0xff
  55
  56 hashAttrNotCopied = set(["dn", "whenCreated", "whenChanged", "objectGUID",
  57     "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
  58     "objectCategory", "distinguishedName", "nTMixedDomain",
  59     "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
  60     "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
  61     "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
  62     "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
  63     "possibleInferiors", "privilege", "sAMAccountType"])
  64
  65
  66 class ProvisionLDB(object):
  67
  68     def __init__(self):
  69         self.sam = None
  70         self.secrets = None
  71         self.idmap = None
  72         self.privilege = None
  73         self.hkcr = None
  74         self.hkcu = None
  75         self.hku = None
  76         self.hklm = None
  77
  78     def dbs(self):
  79         return (self.sam, self.secrets, self.idmap, self.privilege)
  80
  81     def startTransactions(self):
  82         for db in self.dbs():
  83             db.transaction_start()
  84 # TO BE DONE
  85 #        self.hkcr.transaction_start()
  86 #        self.hkcu.transaction_start()
  87 #        self.hku.transaction_start()
  88 #        self.hklm.transaction_start()
  89
  90     def groupedRollback(self):
  91         ok = True
  92         for db in self.dbs():
  93             try:
  94                 db.transaction_cancel()
  95             except Exception:
  96                 ok = False
  97         return ok
  98 # TO BE DONE
  99 #        self.hkcr.transaction_cancel()
 100 #        self.hkcu.transaction_cancel()
 101 #        self.hku.transaction_cancel()
 102 #        self.hklm.transaction_cancel()
 103
 104     def groupedCommit(self):
 105         try:
 106             for db in self.dbs():
 107                 db.transaction_prepare_commit()
 108         except Exception:
 109             return self.groupedRollback()
 110 # TO BE DONE
 111 #        self.hkcr.transaction_prepare_commit()
 112 #        self.hkcu.transaction_prepare_commit()
 113 #        self.hku.transaction_prepare_commit()
 114 #        self.hklm.transaction_prepare_commit()
 115         try:
 116             for db in self.dbs():
 117                 db.transaction_commit()
 118         except Exception:
 119             return self.groupedRollback()
 120
 121 # TO BE DONE
 122 #        self.hkcr.transaction_commit()
 123 #        self.hkcu.transaction_commit()
 124 #        self.hku.transaction_commit()
 125 #        self.hklm.transaction_commit()
 126         return True
 127
 128
 129 def get_ldbs(paths, creds, session, lp):
 130     """Return LDB object mapped on most important databases
 131
 132     :param paths: An object holding the different importants paths for provision object
 133     :param creds: Credential used for openning LDB files
 134     :param session: Session to use for openning LDB files
 135     :param lp: A loadparam object
 136     :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
 137
 138     ldbs = ProvisionLDB()
 139
 140     ldbs.sam = SamDB(paths.samdb, session_info=session, credentials=creds, lp=lp, options=["modules:samba_dsdb"])
 141     ldbs.secrets = Ldb(paths.secrets, session_info=session, credentials=creds, lp=lp)
 142     ldbs.idmap = Ldb(paths.idmapdb, session_info=session, credentials=creds, lp=lp)
 143     ldbs.privilege = Ldb(paths.privilege, session_info=session, credentials=creds, lp=lp)
 144 #    ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
 145 #    ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
 146 #    ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
 147 #    ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
 148
 149     return ldbs
 150
 151
 152 def usn_in_range(usn, range):
 153     """Check if the usn is in one of the range provided.
 154     To do so, the value is checked to be between the lower bound and
 155     higher bound of a range
 156
 157     :param usn: A integer value corresponding to the usn that we want to update
 158     :param range: A list of integer representing ranges, lower bounds are in
 159                   the even indices, higher in odd indices
 160     :return: True if the usn is in one of the range, False otherwise
 161     """
 162
 163     idx = 0
 164     cont = True
 165     ok = False
 166     while cont:
 167         if idx ==  len(range):
 168             cont = False
 169             continue
 170         if usn < int(range[idx]):
 171             if idx %2 == 1:
 172                 ok = True
 173             cont = False
 174         if usn == int(range[idx]):
 175             cont = False
 176             ok = True
 177         idx = idx + 1
 178     return ok
 179
 180
 181 def get_paths(param, targetdir=None, smbconf=None):
 182     """Get paths to important provision objects (smb.conf, ldb files, ...)
 183
 184     :param param: Param object
 185     :param targetdir: Directory where the provision is (or will be) stored
 186     :param smbconf: Path to the smb.conf file
 187     :return: A list with the path of important provision objects"""
 188     if targetdir is not None:
 189         if not os.path.exists(targetdir):
 190             os.mkdir(targetdir)
 191         etcdir = os.path.join(targetdir, "etc")
 192         if not os.path.exists(etcdir):
 193             os.makedirs(etcdir)
 194         smbconf = os.path.join(etcdir, "smb.conf")
 195     if smbconf is None:
 196         smbconf = param.default_path()
 197
 198     if not os.path.exists(smbconf):
 199         raise ProvisioningError("Unable to find smb.conf")
 200
 201     lp = param.LoadParm()
 202     lp.load(smbconf)
 203     paths = provision_paths_from_lp(lp, lp.get("realm"))
 204     return paths
 205
 206 def update_policyids(names, samdb):
 207     """Update policy ids that could have changed after sam update
 208
 209     :param names: List of key provision parameters
 210     :param samdb: An Ldb object conntected with the sam DB
 211     """
 212     # policy guid
 213     res = samdb.search(expression="(displayName=Default Domain Policy)",
 214                         base="CN=Policies,CN=System," + str(names.rootdn),
 215                         scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
 216     names.policyid = str(res[0]["cn"]).replace("{","").replace("}","")
 217     # dc policy guid
 218     res2 = samdb.search(expression="(displayName=Default Domain Controllers"
 219                                    " Policy)",
 220                             base="CN=Policies,CN=System," + str(names.rootdn),
 221                             scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
 222     if len(res2) == 1:
 223         names.policyid_dc = str(res2[0]["cn"]).replace("{","").replace("}","")
 224     else:
 225         names.policyid_dc = None
 226
 227
 228 def newprovision(names, creds, session, smbconf, provdir, logger):
 229     """Create a new provision.
 230
 231     This provision will be the reference for knowing what has changed in the
 232     since the latest upgrade in the current provision
 233
 234     :param names: List of provision parameters
 235     :param creds: Credentials for the authentification
 236     :param session: Session object
 237     :param smbconf: Path to the smb.conf file
 238     :param provdir: Directory where the provision will be stored
 239     :param logger: A Logger
 240     """
 241     if os.path.isdir(provdir):
 242         shutil.rmtree(provdir)
 243     os.mkdir(provdir)
 244     logger.info("Provision stored in %s", provdir)
 245     return provision(logger, session, creds, smbconf=smbconf,
 246             targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm,
 247             domain=names.domain, domainguid=names.domainguid,
 248             domainsid=str(names.domainsid), ntdsguid=names.ntdsguid,
 249             policyguid=names.policyid, policyguid_dc=names.policyid_dc,
 250             hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
 251             invocationid=names.invocation, adminpass=names.adminpass,
 252             krbtgtpass=None, machinepass=None, dnspass=None, root=None,
 253             nobody=None, users=None,
 254             serverrole="domain controller",
 255             backend_type=None, ldapadminpass=None, ol_mmr_urls=None,
 256             slapd_path=None,
 257             dom_for_fun_level=names.domainlevel, dns_backend=names.dns_backend,
 258             useeadb=True, use_ntvfs=True)
 259
 260
 261 def dn_sort(x, y):
 262     """Sorts two DNs in the lexicographical order it and put higher level DN
 263     before.
 264
 265     So given the dns cn=bar,cn=foo and cn=foo the later will be return as
 266     smaller
 267
 268     :param x: First object to compare
 269     :param y: Second object to compare
 270     """
 271     p = re.compile(r'(?<!\\), ?')
 272     tab1 = p.split(str(x))
 273     tab2 = p.split(str(y))
 274     minimum = min(len(tab1), len(tab2))
 275     len1 = len(tab1)-1
 276     len2 = len(tab2)-1
 277     # Note: python range go up to upper limit but do not include it
 278     for i in range(0, minimum):
 279         ret = cmp(tab1[len1-i], tab2[len2-i])
 280         if ret != 0:
 281             return ret
 282         else:
 283             if i == minimum-1:
 284                 assert len1!=len2,"PB PB PB" + " ".join(tab1)+" / " + " ".join(tab2)
 285                 if len1 > len2:
 286                     return 1
 287                 else:
 288                     return -1
 289     return ret
 290
 291
 292 def identic_rename(ldbobj, dn):
 293     """Perform a back and forth rename to trigger renaming on attribute that
 294     can't be directly modified.
 295
 296     :param lbdobj: An Ldb Object
 297     :param dn: DN of the object to manipulate
 298     """
 299     (before, after) = str(dn).split('=', 1)
 300     # we need to use relax to avoid the subtree_rename constraints
 301     ldbobj.rename(dn, ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), ["relax:0"])
 302     ldbobj.rename(ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), dn, ["relax:0"])
 303
 304
 305 def chunck_acl(acl):
 306     """Return separate ACE of an ACL
 307
 308     :param acl: A string representing the ACL
 309     :return: A hash with different parts
 310     """
 311
 312     p = re.compile(r'(\w+)?(\(.*?\))')
 313     tab = p.findall(acl)
 314
 315     hash = {}
 316     hash["aces"] = []
 317     for e in tab:
 318         if len(e[0]) > 0:
 319             hash["flags"] = e[0]
 320         hash["aces"].append(e[1])
 321
 322     return hash
 323
 324
 325 def chunck_sddl(sddl):
 326     """ Return separate parts of the SDDL (owner, group, ...)
 327
 328     :param sddl: An string containing the SDDL to chunk
 329     :return: A hash with the different chunk
 330     """
 331
 332     p = re.compile(r'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
 333     tab = p.findall(sddl)
 334
 335     hash = {}
 336     for e in tab:
 337         if e[0] == "O:":
 338             hash["owner"] = e[1]
 339         if e[0] == "G:":
 340             hash["group"] = e[1]
 341         if e[0] == "D:":
 342             hash["dacl"] = e[1]
 343         if e[0] == "S:":
 344             hash["sacl"] = e[1]
 345
 346     return hash
 347
 348
 349 def get_diff_sds(refsd, cursd, domainsid, checkSacl = True):
 350     """Get the difference between 2 sd
 351
 352     This function split the textual representation of ACL into smaller
 353     chunck in order to not to report a simple permutation as a difference
 354
 355     :param refsddl: First sddl to compare
 356     :param cursddl: Second sddl to compare
 357     :param checkSacl: If false we skip the sacl checks
 358     :return: A string that explain difference between sddls
 359     """
 360
 361     cursddl = cursd.as_sddl(domainsid)
 362     refsddl = refsd.as_sddl(domainsid)
 363
 364     txt = ""
 365     hash_cur = chunck_sddl(cursddl)
 366     hash_ref = chunck_sddl(refsddl)
 367
 368     if not hash_cur.has_key("owner"):
 369         txt = "\tNo owner in current SD"
 370     elif hash_cur["owner"] != hash_ref["owner"]:
 371         txt = "\tOwner mismatch: %s (in ref) %s" \
 372               "(in current)\n" % (hash_ref["owner"], hash_cur["owner"])
 373
 374     if not hash_cur.has_key("group"):
 375         txt = "%s\tNo group in current SD" % txt
 376     elif hash_cur["group"] != hash_ref["group"]:
 377         txt = "%s\tGroup mismatch: %s (in ref) %s" \
 378               "(in current)\n" % (txt, hash_ref["group"], hash_cur["group"])
 379
 380     parts = [ "dacl" ]
 381     if checkSacl:
 382         parts.append("sacl")
 383     for part in parts:
 384         if hash_cur.has_key(part) and hash_ref.has_key(part):
 385
 386             # both are present, check if they contain the same ACE
 387             h_cur = set()
 388             h_ref = set()
 389             c_cur = chunck_acl(hash_cur[part])
 390             c_ref = chunck_acl(hash_ref[part])
 391
 392             for elem in c_cur["aces"]:
 393                 h_cur.add(elem)
 394
 395             for elem in c_ref["aces"]:
 396                 h_ref.add(elem)
 397
 398             for k in set(h_ref):
 399                 if k in h_cur:
 400                     h_cur.remove(k)
 401                     h_ref.remove(k)
 402
 403             if len(h_cur) + len(h_ref) > 0:
 404                 txt = "%s\tPart %s is different between reference" \
 405                       " and current here is the detail:\n" % (txt, part)
 406
 407                 for item in h_cur:
 408                     txt = "%s\t\t%s ACE is not present in the" \
 409                           " reference\n" % (txt, item)
 410
 411                 for item in h_ref:
 412                     txt = "%s\t\t%s ACE is not present in the" \
 413                           " current\n" % (txt, item)
 414
 415         elif hash_cur.has_key(part) and not hash_ref.has_key(part):
 416             txt = "%s\tReference ACL hasn't a %s part\n" % (txt, part)
 417         elif not hash_cur.has_key(part) and hash_ref.has_key(part):
 418             txt = "%s\tCurrent ACL hasn't a %s part\n" % (txt, part)
 419
 420     return txt
 421
 422
 423 def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
 424     """Update secrets.ldb
 425
 426     :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
 427         of the reference provision
 428     :param secrets_ldb: An LDB object that is connected to the secrets.ldb
 429         of the updated provision
 430     """
 431
 432     messagefunc(SIMPLE, "Update of secrets.ldb")
 433     reference = newsecrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 434     current = secrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 435     assert reference, "Reference modules list can not be empty"
 436     if len(current) == 0:
 437         # No modules present
 438         delta = secrets_ldb.msg_diff(ldb.Message(), reference[0])
 439         delta.dn = reference[0].dn
 440         secrets_ldb.add(reference[0])
 441     else:
 442         delta = secrets_ldb.msg_diff(current[0], reference[0])
 443         delta.dn = current[0].dn
 444         secrets_ldb.modify(delta)
 445
 446     reference = newsecrets_ldb.search(expression="objectClass=top", base="",
 447                                         scope=SCOPE_SUBTREE, attrs=["dn"])
 448     current = secrets_ldb.search(expression="objectClass=top", base="",
 449                                         scope=SCOPE_SUBTREE, attrs=["dn"])
 450     hash_new = {}
 451     hash = {}
 452     listMissing = []
 453     listPresent = []
 454
 455     empty = ldb.Message()
 456     for i in range(0, len(reference)):
 457         hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"]
 458
 459     # Create a hash for speeding the search of existing object in the
 460     # current provision
 461     for i in range(0, len(current)):
 462         hash[str(current[i]["dn"]).lower()] = current[i]["dn"]
 463
 464     for k in hash_new.keys():
 465         if not hash.has_key(k):
 466             listMissing.append(hash_new[k])
 467         else:
 468             listPresent.append(hash_new[k])
 469
 470     for entry in listMissing:
 471         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 472                                             base="", scope=SCOPE_SUBTREE)
 473         current = secrets_ldb.search(expression="distinguishedName=%s" % entry,
 474                                             base="", scope=SCOPE_SUBTREE)
 475         delta = secrets_ldb.msg_diff(empty, reference[0])
 476         for att in hashAttrNotCopied:
 477             delta.remove(att)
 478         messagefunc(CHANGE, "Entry %s is missing from secrets.ldb" %
 479                     reference[0].dn)
 480         for att in delta:
 481             messagefunc(CHANGE, " Adding attribute %s" % att)
 482         delta.dn = reference[0].dn
 483         secrets_ldb.add(delta)
 484
 485     for entry in listPresent:
 486         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 487                                             base="", scope=SCOPE_SUBTREE)
 488         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 489                                             scope=SCOPE_SUBTREE)
 490         delta = secrets_ldb.msg_diff(current[0], reference[0])
 491         for att in hashAttrNotCopied:
 492             delta.remove(att)
 493         for att in delta:
 494             if att == "name":
 495                 messagefunc(CHANGE, "Found attribute name on  %s,"
 496                                     " must rename the DN" % (current[0].dn))
 497                 identic_rename(secrets_ldb, reference[0].dn)
 498             else:
 499                 delta.remove(att)
 500
 501     for entry in listPresent:
 502         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 503                                             scope=SCOPE_SUBTREE)
 504         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 505                                             scope=SCOPE_SUBTREE)
 506         delta = secrets_ldb.msg_diff(current[0], reference[0])
 507         for att in hashAttrNotCopied:
 508             delta.remove(att)
 509         for att in delta:
 510             if att == "msDS-KeyVersionNumber":
 511                 delta.remove(att)
 512             if att != "dn":
 513                 messagefunc(CHANGE,
 514                             "Adding/Changing attribute %s to %s" %
 515                             (att, current[0].dn))
 516
 517         delta.dn = current[0].dn
 518         secrets_ldb.modify(delta)
 519
 520     res2 = secrets_ldb.search(expression="(samaccountname=dns)",
 521                                 scope=SCOPE_SUBTREE, attrs=["dn"])
 522
 523     if len(res2) == 1:
 524             messagefunc(SIMPLE, "Remove old dns account")
 525             secrets_ldb.delete(res2[0]["dn"])
 526
 527
 528 def getOEMInfo(samdb, rootdn):
 529     """Return OEM Information on the top level Samba4 use to store version
 530     info in this field
 531
 532     :param samdb: An LDB object connect to sam.ldb
 533     :param rootdn: Root DN of the domain
 534     :return: The content of the field oEMInformation (if any)
 535     """
 536     res = samdb.search(expression="(objectClass=*)", base=str(rootdn),
 537                             scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 538     if len(res) > 0 and res[0].get("oEMInformation"):
 539         info = res[0]["oEMInformation"]
 540         return info
 541     else:
 542         return ""
 543
 544
 545 def updateOEMInfo(samdb, rootdn):
 546     """Update the OEMinfo field to add information about upgrade
 547
 548     :param samdb: an LDB object connected to the sam DB
 549     :param rootdn: The string representation of the root DN of
 550         the provision (ie. DC=...,DC=...)
 551     """
 552     res = samdb.search(expression="(objectClass=*)", base=rootdn,
 553                             scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 554     if len(res) > 0:
 555         if res[0].get("oEMInformation"):
 556             info = str(res[0]["oEMInformation"])
 557         else:
 558             info = ""
 559         info = "%s, upgrade to %s" % (info, version)
 560         delta = ldb.Message()
 561         delta.dn = ldb.Dn(samdb, str(res[0]["dn"]))
 562         delta["oEMInformation"] = ldb.MessageElement(info, ldb.FLAG_MOD_REPLACE,
 563                                                         "oEMInformation" )
 564         samdb.modify(delta)
 565
 566 def update_gpo(paths, samdb, names, lp, message):
 567     """Create missing GPO file object if needed
 568     """
 569     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid)
 570     if not os.path.isdir(dir):
 571         create_gpo_struct(dir)
 572
 573     if names.policyid_dc is None:
 574         raise ProvisioningError("Policy ID for Domain controller is missing")
 575     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
 576     if not os.path.isdir(dir):
 577         create_gpo_struct(dir)
 578
 579 def increment_calculated_keyversion_number(samdb, rootdn, hashDns):
 580     """For a given hash associating dn and a number, this function will
 581     update the replPropertyMetaData of each dn in the hash, so that the
 582     calculated value of the msDs-KeyVersionNumber is equal or superior to the
 583     one associated to the given dn.
 584
 585     :param samdb: An SamDB object pointing to the sam
 586     :param rootdn: The base DN where we want to start
 587     :param hashDns: A hash with dn as key and number representing the
 588                  minimum value of msDs-KeyVersionNumber that we want to
 589                  have
 590     """
 591     entry = samdb.search(expression='(objectClass=user)',
 592                          base=ldb.Dn(samdb,str(rootdn)),
 593                          scope=SCOPE_SUBTREE, attrs=["msDs-KeyVersionNumber"],
 594                          controls=["search_options:1:2"])
 595     done = 0
 596     hashDone = {}
 597     if len(entry) == 0:
 598         raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
 599     else:
 600         for e in entry:
 601             if hashDns.has_key(str(e.dn).lower()):
 602                 val = e.get("msDs-KeyVersionNumber")
 603                 if not val:
 604                     val = "0"
 605                 version = int(str(hashDns[str(e.dn).lower()]))
 606                 if int(str(val)) < version:
 607                     done = done + 1
 608                     samdb.set_attribute_replmetadata_version(str(e.dn),
 609                                                               "unicodePwd",
 610                                                               version, True)
 611 def delta_update_basesamdb(refsampath, sampath, creds, session, lp, message):
 612     """Update the provision container db: sam.ldb
 613     This function is aimed for alpha9 and newer;
 614
 615     :param refsampath: Path to the samdb in the reference provision
 616     :param sampath: Path to the samdb in the upgraded provision
 617     :param creds: Credential used for openning LDB files
 618     :param session: Session to use for openning LDB files
 619     :param lp: A loadparam object
 620     :return: A msg_diff object with the difference between the @ATTRIBUTES
 621              of the current provision and the reference provision
 622     """
 623
 624     message(SIMPLE,
 625             "Update base samdb by searching difference with reference one")
 626     refsam = Ldb(refsampath, session_info=session, credentials=creds,
 627                     lp=lp, options=["modules:"])
 628     sam = Ldb(sampath, session_info=session, credentials=creds, lp=lp,
 629                 options=["modules:"])
 630
 631     empty = ldb.Message()
 632     deltaattr = None
 633     reference = refsam.search(expression="")
 634
 635     for refentry in reference:
 636         entry = sam.search(expression="distinguishedName=%s" % refentry["dn"],
 637                             scope=SCOPE_SUBTREE)
 638         if not len(entry):
 639             delta = sam.msg_diff(empty, refentry)
 640             message(CHANGE, "Adding %s to sam db" % str(refentry.dn))
 641             if str(refentry.dn) == "@PROVISION" and\
 642                 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 643                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 644             delta.dn = refentry.dn
 645             sam.add(delta)
 646         else:
 647             delta = sam.msg_diff(entry[0], refentry)
 648             if str(refentry.dn) == "@ATTRIBUTES":
 649                 deltaattr = sam.msg_diff(refentry, entry[0])
 650             if str(refentry.dn) == "@PROVISION" and\
 651                 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 652                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 653             if len(delta.items()) > 1:
 654                 delta.dn = refentry.dn
 655                 sam.modify(delta)
 656
 657     return deltaattr
 658
 659
 660 def construct_existor_expr(attrs):
 661     """Construct a exists or LDAP search expression.
 662
 663     :param attrs: List of attribute on which we want to create the search
 664         expression.
 665     :return: A string representing the expression, if attrs is empty an
 666         empty string is returned
 667     """
 668     expr = ""
 669     if len(attrs) > 0:
 670         expr = "(|"
 671         for att in attrs:
 672             expr = "%s(%s=*)"%(expr,att)
 673         expr = "%s)"%expr
 674     return expr
 675
 676 def update_machine_account_password(samdb, secrets_ldb, names):
 677     """Update (change) the password of the current DC both in the SAM db and in
 678        secret one
 679
 680     :param samdb: An LDB object related to the sam.ldb file of a given provision
 681     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 682                         provision
 683     :param names: List of key provision parameters"""
 684
 685     expression = "samAccountName=%s$" % names.netbiosname
 686     secrets_msg = secrets_ldb.search(expression=expression,
 687                                         attrs=["secureChannelType"])
 688     if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC:
 689         res = samdb.search(expression=expression, attrs=[])
 690         assert(len(res) == 1)
 691
 692         msg = ldb.Message(res[0].dn)
 693         machinepass = samba.generate_random_password(128, 255)
 694         mputf16 = machinepass.encode('utf-16-le')
 695         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 696                                                 ldb.FLAG_MOD_REPLACE,
 697                                                 "clearTextPassword")
 698         samdb.modify(msg)
 699
 700         res = samdb.search(expression=("samAccountName=%s$" % names.netbiosname),
 701                      attrs=["msDs-keyVersionNumber"])
 702         assert(len(res) == 1)
 703         kvno = int(str(res[0]["msDs-keyVersionNumber"]))
 704         secChanType = int(secrets_msg[0]["secureChannelType"][0])
 705
 706         secretsdb_self_join(secrets_ldb, domain=names.domain,
 707                     realm=names.realm,
 708                     domainsid=names.domainsid,
 709                     dnsdomain=names.dnsdomain,
 710                     netbiosname=names.netbiosname,
 711                     machinepass=machinepass,
 712                     key_version_number=kvno,
 713                     secure_channel_type=secChanType)
 714     else:
 715         raise ProvisioningError("Unable to find a Secure Channel"
 716                                 "of type SEC_CHAN_BDC")
 717
 718 def update_dns_account_password(samdb, secrets_ldb, names):
 719     """Update (change) the password of the dns both in the SAM db and in
 720        secret one
 721
 722     :param samdb: An LDB object related to the sam.ldb file of a given provision
 723     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 724                         provision
 725     :param names: List of key provision parameters"""
 726
 727     expression = "samAccountName=dns-%s" % names.netbiosname
 728     secrets_msg = secrets_ldb.search(expression=expression)
 729     if len(secrets_msg) == 1:
 730         res = samdb.search(expression=expression, attrs=[])
 731         assert(len(res) == 1)
 732
 733         msg = ldb.Message(res[0].dn)
 734         machinepass = samba.generate_random_password(128, 255)
 735         mputf16 = machinepass.encode('utf-16-le')
 736         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 737                                                 ldb.FLAG_MOD_REPLACE,
 738                                                 "clearTextPassword")
 739
 740         samdb.modify(msg)
 741
 742         res = samdb.search(expression=expression,
 743                      attrs=["msDs-keyVersionNumber"])
 744         assert(len(res) == 1)
 745         kvno = str(res[0]["msDs-keyVersionNumber"])
 746
 747         msg = ldb.Message(secrets_msg[0].dn)
 748         msg["secret"] = ldb.MessageElement(machinepass,
 749                                                 ldb.FLAG_MOD_REPLACE,
 750                                                 "secret")
 751         msg["msDS-KeyVersionNumber"] = ldb.MessageElement(kvno,
 752                                                 ldb.FLAG_MOD_REPLACE,
 753                                                 "msDS-KeyVersionNumber")
 754
 755         secrets_ldb.modify(msg)
 756
 757 def search_constructed_attrs_stored(samdb, rootdn, attrs):
 758     """Search a given sam DB for calculated attributes that are
 759     still stored in the db.
 760
 761     :param samdb: An LDB object pointing to the sam
 762     :param rootdn: The base DN where the search should start
 763     :param attrs: A list of attributes to be searched
 764     :return: A hash with attributes as key and an array of
 765              array. Each array contains the dn and the associated
 766              values for this attribute as they are stored in the
 767              sam."""
 768
 769     hashAtt = {}
 770     expr = construct_existor_expr(attrs)
 771     if expr == "":
 772         return hashAtt
 773     entry = samdb.search(expression=expr, base=ldb.Dn(samdb, str(rootdn)),
 774                          scope=SCOPE_SUBTREE, attrs=attrs,
 775                          controls=["search_options:1:2","bypassoperational:0"])
 776     if len(entry) == 0:
 777         # Nothing anymore
 778         return hashAtt
 779
 780     for ent in entry:
 781         for att in attrs:
 782             if ent.get(att):
 783                 if hashAtt.has_key(att):
 784                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 785                 else:
 786                     hashAtt[att] = {}
 787                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 788
 789     return hashAtt
 790
 791 def findprovisionrange(samdb, basedn):
 792     """ Find ranges of usn grouped by invocation id and then by timestamp
 793         rouned at 1 minute
 794
 795         :param samdb: An LDB object pointing to the samdb
 796         :param basedn: The DN of the forest
 797
 798         :return: A two level dictionary with invoication id as the
 799                 first level, timestamp as the second one and then
 800                 max, min, and number as subkeys, representing respectivily
 801                 the maximum usn for the range, the minimum usn and the number
 802                 of object with usn in this range.
 803     """
 804     nb_obj = 0
 805     hash_id = {}
 806
 807     res = samdb.search(base=basedn, expression="objectClass=*",
 808                                     scope=ldb.SCOPE_SUBTREE,
 809                                     attrs=["replPropertyMetaData"],
 810                                     controls=["search_options:1:2"])
 811
 812     for e in res:
 813         nb_obj = nb_obj + 1
 814         obj = ndr_unpack(drsblobs.replPropertyMetaDataBlob,
 815                             str(e["replPropertyMetaData"])).ctr
 816
 817         for o in obj.array:
 818             # like a timestamp but with the resolution of 1 minute
 819             minutestamp =_glue.nttime2unix(o.originating_change_time)/60
 820             hash_ts = hash_id.get(str(o.originating_invocation_id))
 821
 822             if hash_ts is None:
 823                 ob = {}
 824                 ob["min"] = o.originating_usn
 825                 ob["max"] = o.originating_usn
 826                 ob["num"] = 1
 827                 ob["list"] = [str(e.dn)]
 828                 hash_ts = {}
 829             else:
 830                 ob = hash_ts.get(minutestamp)
 831                 if ob is None:
 832                     ob = {}
 833                     ob["min"] = o.originating_usn
 834                     ob["max"] = o.originating_usn
 835                     ob["num"] = 1
 836                     ob["list"] = [str(e.dn)]
 837                 else:
 838                     if ob["min"] > o.originating_usn:
 839                         ob["min"] = o.originating_usn
 840                     if ob["max"] < o.originating_usn:
 841                         ob["max"] = o.originating_usn
 842                     if not (str(e.dn) in ob["list"]):
 843                         ob["num"] = ob["num"] + 1
 844                         ob["list"].append(str(e.dn))
 845             hash_ts[minutestamp] = ob
 846             hash_id[str(o.originating_invocation_id)] = hash_ts
 847
 848     return (hash_id, nb_obj)
 849
 850 def print_provision_ranges(dic, limit_print, dest, samdb_path, invocationid):
 851     """ print the differents ranges passed as parameter
 852
 853         :param dic: A dictionnary as returned by findprovisionrange
 854         :param limit_print: minimum number of object in a range in order to print it
 855         :param dest: Destination directory
 856         :param samdb_path: Path to the sam.ldb file
 857         :param invoicationid: Invocation ID for the current provision
 858     """
 859     ldif = ""
 860
 861     for id in dic:
 862         hash_ts = dic[id]
 863         sorted_keys = []
 864         sorted_keys.extend(hash_ts.keys())
 865         sorted_keys.sort()
 866
 867         kept_record = []
 868         for k in sorted_keys:
 869             obj = hash_ts[k]
 870             if obj["num"] > limit_print:
 871                 dt = _glue.nttime2string(_glue.unix2nttime(k*60))
 872                 print "%s # of modification: %d  \tmin: %d max: %d" % (dt , obj["num"],
 873                                                                     obj["min"],
 874                                                                     obj["max"])
 875             if hash_ts[k]["num"] > 600:
 876                 kept_record.append(k)
 877
 878         # Let's try to concatenate consecutive block if they are in the almost same minutestamp
 879         for i in range(0, len(kept_record)):
 880             if i != 0:
 881                 key1 = kept_record[i]
 882                 key2 = kept_record[i-1]
 883                 if key1 - key2 == 1:
 884                     # previous record is just 1 minute away from current
 885                     if int(hash_ts[key1]["min"]) == int(hash_ts[key2]["max"]) + 1:
 886                         # Copy the highest USN in the previous record
 887                         # and mark the current as skipped
 888                         hash_ts[key2]["max"] = hash_ts[key1]["max"]
 889                         hash_ts[key1]["skipped"] = True
 890
 891         for k in kept_record:
 892                 obj = hash_ts[k]
 893                 if obj.get("skipped") is None:
 894                     ldif = "%slastProvisionUSN: %d-%d;%s\n" % (ldif, obj["min"],
 895                                 obj["max"], id)
 896
 897     if ldif != "":
 898         file = tempfile.mktemp(dir=dest, prefix="usnprov", suffix=".ldif")
 899         print
 900         print "To track the USNs modified/created by provision and upgrade proivsion,"
 901         print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
 902         print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
 903         print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path),file)
 904         ldif = "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid, ldif)
 905         open(file,'w').write(ldif)
 906
 907 def int64range2str(value):
 908     """Display the int64 range stored in value as xxx-yyy
 909
 910     :param value: The int64 range
 911     :return: A string of the representation of the range
 912     """
 913
 914     lvalue = long(value)
 915     str = "%d-%d" % (lvalue&0xFFFFFFFF, lvalue>>32)
 916     return str