python/samba/upgradehelpers.py

   1 # Helpers for provision stuff
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
   3 #
   4 # Based on provision a Samba4 server by
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 """Helpers used for upgrading between different database formats."""
  23
  24 import os
  25 import re
  26 import shutil
  27 import samba
  28
  29 from samba.common import cmp
  30 from samba import Ldb, version, ntacls
  31 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
  32 import ldb
  33 from samba.provision import (provision_paths_from_lp,
  34                              getpolicypath, create_gpo_struct,
  35                              provision, ProvisioningError,
  36                              secretsdb_self_join)
  37 from samba.provision.common import FILL_FULL
  38 from samba.dcerpc import drsblobs
  39 from samba.dcerpc.misc import SEC_CHAN_BDC
  40 from samba.ndr import ndr_unpack
  41 from samba.samdb import SamDB
  42 from samba import _glue
  43 import tempfile
  44
  45 # All the ldb related to registry are commented because the path for them is
  46 # relative in the provisionPath object
  47 # And so opening them create a file in the current directory which is not what
  48 # we want
  49 # I still keep them commented because I plan soon to make more cleaner
  50 ERROR = -1
  51 SIMPLE = 0x00
  52 CHANGE = 0x01
  53 CHANGESD = 0x02
  54 GUESS = 0x04
  55 PROVISION = 0x08
  56 CHANGEALL = 0xff
  57
  58 hashAttrNotCopied = set(["dn", "whenCreated", "whenChanged", "objectGUID",
  59                          "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
  60                          "objectCategory", "distinguishedName", "nTMixedDomain",
  61                          "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
  62                          "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
  63                          "ntPwdHistory", "unicodePwd", "dBCSPwd", "supplementalCredentials",
  64                          "gPCUserExtensionNames", "gPCMachineExtensionNames", "maxPwdAge", "secret",
  65                          "possibleInferiors", "privilege", "sAMAccountType"])
  66
  67
  68 class ProvisionLDB(object):
  69
  70     def __init__(self):
  71         self.sam = None
  72         self.secrets = None
  73         self.idmap = None
  74         self.privilege = None
  75         self.hkcr = None
  76         self.hkcu = None
  77         self.hku = None
  78         self.hklm = None
  79
  80     def dbs(self):
  81         return (self.sam, self.secrets, self.idmap, self.privilege)
  82
  83     def startTransactions(self):
  84         for db in self.dbs():
  85             db.transaction_start()
  86 # TO BE DONE
  87 #        self.hkcr.transaction_start()
  88 #        self.hkcu.transaction_start()
  89 #        self.hku.transaction_start()
  90 #        self.hklm.transaction_start()
  91
  92     def groupedRollback(self):
  93         ok = True
  94         for db in self.dbs():
  95             try:
  96                 db.transaction_cancel()
  97             except Exception:
  98                 ok = False
  99         return ok
 100 # TO BE DONE
 101 #        self.hkcr.transaction_cancel()
 102 #        self.hkcu.transaction_cancel()
 103 #        self.hku.transaction_cancel()
 104 #        self.hklm.transaction_cancel()
 105
 106     def groupedCommit(self):
 107         try:
 108             for db in self.dbs():
 109                 db.transaction_prepare_commit()
 110         except Exception:
 111             return self.groupedRollback()
 112 # TO BE DONE
 113 #        self.hkcr.transaction_prepare_commit()
 114 #        self.hkcu.transaction_prepare_commit()
 115 #        self.hku.transaction_prepare_commit()
 116 #        self.hklm.transaction_prepare_commit()
 117         try:
 118             for db in self.dbs():
 119                 db.transaction_commit()
 120         except Exception:
 121             return self.groupedRollback()
 122
 123 # TO BE DONE
 124 #        self.hkcr.transaction_commit()
 125 #        self.hkcu.transaction_commit()
 126 #        self.hku.transaction_commit()
 127 #        self.hklm.transaction_commit()
 128         return True
 129
 130
 131 def get_ldbs(paths, creds, session, lp):
 132     """Return LDB object mapped on most important databases
 133
 134     :param paths: An object holding the different importants paths for provision object
 135     :param creds: Credential used for openning LDB files
 136     :param session: Session to use for openning LDB files
 137     :param lp: A loadparam object
 138     :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
 139
 140     ldbs = ProvisionLDB()
 141
 142     ldbs.sam = SamDB(paths.samdb,
 143                      session_info=session,
 144                      credentials=creds,
 145                      lp=lp,
 146                      options=["modules:samba_dsdb"],
 147                      flags=0)
 148     ldbs.secrets = Ldb(paths.secrets, session_info=session, credentials=creds, lp=lp)
 149     ldbs.idmap = Ldb(paths.idmapdb, session_info=session, credentials=creds, lp=lp)
 150     ldbs.privilege = Ldb(paths.privilege, session_info=session, credentials=creds, lp=lp)
 151 #    ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
 152 #    ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
 153 #    ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
 154 #    ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
 155
 156     return ldbs
 157
 158
 159 def usn_in_range(usn, range):
 160     """Check if the usn is in one of the range provided.
 161     To do so, the value is checked to be between the lower bound and
 162     higher bound of a range
 163
 164     :param usn: A integer value corresponding to the usn that we want to update
 165     :param range: A list of integer representing ranges, lower bounds are in
 166                   the even indices, higher in odd indices
 167     :return: True if the usn is in one of the range, False otherwise
 168     """
 169
 170     idx = 0
 171     cont = True
 172     ok = False
 173     while cont:
 174         if idx == len(range):
 175             cont = False
 176             continue
 177         if usn < int(range[idx]):
 178             if idx % 2 == 1:
 179                 ok = True
 180             cont = False
 181         if usn == int(range[idx]):
 182             cont = False
 183             ok = True
 184         idx = idx + 1
 185     return ok
 186
 187
 188 def get_paths(param, targetdir=None, smbconf=None):
 189     """Get paths to important provision objects (smb.conf, ldb files, ...)
 190
 191     :param param: Param object
 192     :param targetdir: Directory where the provision is (or will be) stored
 193     :param smbconf: Path to the smb.conf file
 194     :return: A list with the path of important provision objects"""
 195     if targetdir is not None:
 196         if not os.path.exists(targetdir):
 197             os.mkdir(targetdir)
 198         etcdir = os.path.join(targetdir, "etc")
 199         if not os.path.exists(etcdir):
 200             os.makedirs(etcdir)
 201         smbconf = os.path.join(etcdir, "smb.conf")
 202     if smbconf is None:
 203         smbconf = param.default_path()
 204
 205     if not os.path.exists(smbconf):
 206         raise ProvisioningError("Unable to find smb.conf at %s" % smbconf)
 207
 208     lp = param.LoadParm()
 209     lp.load(smbconf)
 210     paths = provision_paths_from_lp(lp, lp.get("realm"))
 211     return paths
 212
 213
 214 def update_policyids(names, samdb):
 215     """Update policy ids that could have changed after sam update
 216
 217     :param names: List of key provision parameters
 218     :param samdb: An Ldb object conntected with the sam DB
 219     """
 220     # policy guid
 221     res = samdb.search(expression="(displayName=Default Domain Policy)",
 222                        base="CN=Policies,CN=System," + str(names.rootdn),
 223                        scope=SCOPE_ONELEVEL, attrs=["cn", "displayName"])
 224     names.policyid = str(res[0]["cn"]).replace("{", "").replace("}", "")
 225     # dc policy guid
 226     res2 = samdb.search(expression="(displayName=Default Domain Controllers"
 227                                    " Policy)",
 228                         base="CN=Policies,CN=System," + str(names.rootdn),
 229                         scope=SCOPE_ONELEVEL, attrs=["cn", "displayName"])
 230     if len(res2) == 1:
 231         names.policyid_dc = str(res2[0]["cn"]).replace("{", "").replace("}", "")
 232     else:
 233         names.policyid_dc = None
 234
 235
 236 def newprovision(names, session, smbconf, provdir, logger, base_schema=None):
 237     """Create a new provision.
 238
 239     This provision will be the reference for knowing what has changed in the
 240     since the latest upgrade in the current provision
 241
 242     :param names: List of provision parameters
 243     :param creds: Credentials for the authentification
 244     :param session: Session object
 245     :param smbconf: Path to the smb.conf file
 246     :param provdir: Directory where the provision will be stored
 247     :param logger: A Logger
 248     """
 249     if os.path.isdir(provdir):
 250         shutil.rmtree(provdir)
 251     os.mkdir(provdir)
 252     logger.info("Provision stored in %s", provdir)
 253     return provision(logger, session, smbconf=smbconf,
 254                      targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm,
 255                      domain=names.domain, domainguid=names.domainguid,
 256                      domainsid=names.domainsid, ntdsguid=names.ntdsguid,
 257                      policyguid=names.policyid, policyguid_dc=names.policyid_dc,
 258                      hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
 259                      invocationid=names.invocation, adminpass=names.adminpass,
 260                      krbtgtpass=None, machinepass=None, dnspass=None, root=None,
 261                      nobody=None, users=None,
 262                      serverrole="domain controller",
 263                      dom_for_fun_level=names.domainlevel, dns_backend=names.dns_backend,
 264                      useeadb=True, use_ntvfs=True, base_schema=base_schema)
 265
 266
 267 def dn_sort(x, y):
 268     """Sorts two DNs in the lexicographical order it and put higher level DN
 269     before.
 270
 271     So given the dns cn=bar,cn=foo and cn=foo the later will be return as
 272     smaller
 273
 274     :param x: First object to compare
 275     :param y: Second object to compare
 276     """
 277     p = re.compile(r'(?<!\\), ?')
 278     tab1 = p.split(str(x))
 279     tab2 = p.split(str(y))
 280     minimum = min(len(tab1), len(tab2))
 281     len1 = len(tab1) - 1
 282     len2 = len(tab2) - 1
 283     # Note: python range go up to upper limit but do not include it
 284     for i in range(0, minimum):
 285         ret = cmp(tab1[len1 - i], tab2[len2 - i])
 286         if ret != 0:
 287             return ret
 288         else:
 289             if i == minimum - 1:
 290                 assert len1 != len2, "PB PB PB" + " ".join(tab1) + " / " + " ".join(tab2)
 291                 if len1 > len2:
 292                     return 1
 293                 else:
 294                     return -1
 295     return ret
 296
 297
 298 def identic_rename(ldbobj, dn):
 299     """Perform a back and forth rename to trigger renaming on attribute that
 300     can't be directly modified.
 301
 302     :param lbdobj: An Ldb Object
 303     :param dn: DN of the object to manipulate
 304     """
 305     (before, after) = str(dn).split('=', 1)
 306     # we need to use relax to avoid the subtree_rename constraints
 307     ldbobj.rename(dn, ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), ["relax:0"])
 308     ldbobj.rename(ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), dn, ["relax:0"])
 309
 310
 311 def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
 312     """Update secrets.ldb
 313
 314     :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
 315         of the reference provision
 316     :param secrets_ldb: An LDB object that is connected to the secrets.ldb
 317         of the updated provision
 318     """
 319
 320     messagefunc(SIMPLE, "Update of secrets.ldb")
 321     reference = newsecrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 322     current = secrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 323     assert reference, "Reference modules list can not be empty"
 324     if len(current) == 0:
 325         # No modules present
 326         delta = secrets_ldb.msg_diff(ldb.Message(), reference[0])
 327         delta.dn = reference[0].dn
 328         secrets_ldb.add(reference[0])
 329     else:
 330         delta = secrets_ldb.msg_diff(current[0], reference[0])
 331         delta.dn = current[0].dn
 332         secrets_ldb.modify(delta)
 333
 334     reference = newsecrets_ldb.search(expression="objectClass=top", base="",
 335                                       scope=SCOPE_SUBTREE, attrs=["dn"])
 336     current = secrets_ldb.search(expression="objectClass=top", base="",
 337                                  scope=SCOPE_SUBTREE, attrs=["dn"])
 338     hash_new = {}
 339     hash = {}
 340     listMissing = []
 341     listPresent = []
 342
 343     empty = ldb.Message()
 344     for i in range(0, len(reference)):
 345         hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"]
 346
 347     # Create a hash for speeding the search of existing object in the
 348     # current provision
 349     for i in range(0, len(current)):
 350         hash[str(current[i]["dn"]).lower()] = current[i]["dn"]
 351
 352     for k in hash_new.keys():
 353         if k not in hash:
 354             listMissing.append(hash_new[k])
 355         else:
 356             listPresent.append(hash_new[k])
 357
 358     for entry in listMissing:
 359         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 360                                           base="", scope=SCOPE_SUBTREE)
 361         delta = secrets_ldb.msg_diff(empty, reference[0])
 362         for att in hashAttrNotCopied:
 363             delta.remove(att)
 364         messagefunc(CHANGE, "Entry %s is missing from secrets.ldb" %
 365                     reference[0].dn)
 366         for att in delta:
 367             messagefunc(CHANGE, " Adding attribute %s" % att)
 368         delta.dn = reference[0].dn
 369         secrets_ldb.add(delta)
 370
 371     for entry in listPresent:
 372         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 373                                           base="", scope=SCOPE_SUBTREE)
 374         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 375                                      scope=SCOPE_SUBTREE)
 376         delta = secrets_ldb.msg_diff(current[0], reference[0])
 377         for att in hashAttrNotCopied:
 378             delta.remove(att)
 379         for att in delta:
 380             if att == "name":
 381                 messagefunc(CHANGE, "Found attribute name on  %s,"
 382                                     " must rename the DN" % (current[0].dn))
 383                 identic_rename(secrets_ldb, reference[0].dn)
 384             else:
 385                 delta.remove(att)
 386
 387     for entry in listPresent:
 388         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 389                                           scope=SCOPE_SUBTREE)
 390         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 391                                      scope=SCOPE_SUBTREE)
 392         delta = secrets_ldb.msg_diff(current[0], reference[0])
 393         for att in hashAttrNotCopied:
 394             delta.remove(att)
 395         for att in delta:
 396             if att == "msDS-KeyVersionNumber":
 397                 delta.remove(att)
 398             if att != "dn":
 399                 messagefunc(CHANGE,
 400                             "Adding/Changing attribute %s to %s" %
 401                             (att, current[0].dn))
 402
 403         delta.dn = current[0].dn
 404         secrets_ldb.modify(delta)
 405
 406     res2 = secrets_ldb.search(expression="(samaccountname=dns)",
 407                               scope=SCOPE_SUBTREE, attrs=["dn"])
 408
 409     if len(res2) == 1:
 410             messagefunc(SIMPLE, "Remove old dns account")
 411             secrets_ldb.delete(res2[0]["dn"])
 412
 413
 414 def getOEMInfo(samdb, rootdn):
 415     """Return OEM Information on the top level Samba4 use to store version
 416     info in this field
 417
 418     :param samdb: An LDB object connect to sam.ldb
 419     :param rootdn: Root DN of the domain
 420     :return: The content of the field oEMInformation (if any)
 421     """
 422     res = samdb.search(expression="(objectClass=*)", base=str(rootdn),
 423                        scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 424     if len(res) > 0 and res[0].get("oEMInformation"):
 425         info = res[0]["oEMInformation"]
 426         return info
 427     else:
 428         return ""
 429
 430
 431 def updateOEMInfo(samdb, rootdn):
 432     """Update the OEMinfo field to add information about upgrade
 433
 434     :param samdb: an LDB object connected to the sam DB
 435     :param rootdn: The string representation of the root DN of
 436         the provision (ie. DC=...,DC=...)
 437     """
 438     res = samdb.search(expression="(objectClass=*)", base=rootdn,
 439                        scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 440     if len(res) > 0:
 441         if res[0].get("oEMInformation"):
 442             info = str(res[0]["oEMInformation"])
 443         else:
 444             info = ""
 445         info = "%s, upgrade to %s" % (info, version)
 446         delta = ldb.Message()
 447         delta.dn = ldb.Dn(samdb, str(res[0]["dn"]))
 448         delta["oEMInformation"] = ldb.MessageElement(info, ldb.FLAG_MOD_REPLACE,
 449                                                      "oEMInformation")
 450         samdb.modify(delta)
 451
 452
 453 def update_gpo(paths, samdb, names, lp, message):
 454     """Create missing GPO file object if needed
 455     """
 456     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid)
 457     if not os.path.isdir(dir):
 458         create_gpo_struct(dir)
 459
 460     if names.policyid_dc is None:
 461         raise ProvisioningError("Policy ID for Domain controller is missing")
 462     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
 463     if not os.path.isdir(dir):
 464         create_gpo_struct(dir)
 465
 466
 467 def increment_calculated_keyversion_number(samdb, rootdn, hashDns):
 468     """For a given hash associating dn and a number, this function will
 469     update the replPropertyMetaData of each dn in the hash, so that the
 470     calculated value of the msDs-KeyVersionNumber is equal or superior to the
 471     one associated to the given dn.
 472
 473     :param samdb: An SamDB object pointing to the sam
 474     :param rootdn: The base DN where we want to start
 475     :param hashDns: A hash with dn as key and number representing the
 476                  minimum value of msDs-KeyVersionNumber that we want to
 477                  have
 478     """
 479     entry = samdb.search(expression='(objectClass=user)',
 480                          base=ldb.Dn(samdb, str(rootdn)),
 481                          scope=SCOPE_SUBTREE, attrs=["msDs-KeyVersionNumber"],
 482                          controls=["search_options:1:2"])
 483     done = 0
 484     if len(entry) == 0:
 485         raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
 486     else:
 487         for e in entry:
 488             if str(e.dn).lower() in hashDns:
 489                 val = e.get("msDs-KeyVersionNumber")
 490                 if not val:
 491                     val = "0"
 492                 version = int(str(hashDns[str(e.dn).lower()]))
 493                 if int(str(val)) < version:
 494                     done = done + 1
 495                     samdb.set_attribute_replmetadata_version(str(e.dn),
 496                                                              "unicodePwd",
 497                                                              version, True)
 498
 499
 500 def delta_update_basesamdb(refsampath, sampath, creds, session, lp, message):
 501     """Update the provision container db: sam.ldb
 502     This function is aimed for alpha9 and newer;
 503
 504     :param refsampath: Path to the samdb in the reference provision
 505     :param sampath: Path to the samdb in the upgraded provision
 506     :param creds: Credential used for openning LDB files
 507     :param session: Session to use for openning LDB files
 508     :param lp: A loadparam object
 509     :return: A msg_diff object with the difference between the @ATTRIBUTES
 510              of the current provision and the reference provision
 511     """
 512
 513     message(SIMPLE,
 514             "Update base samdb by searching difference with reference one")
 515     refsam = Ldb(refsampath, session_info=session, credentials=creds,
 516                  lp=lp, options=["modules:"])
 517     sam = Ldb(sampath, session_info=session, credentials=creds, lp=lp,
 518               options=["modules:"])
 519
 520     empty = ldb.Message()
 521     deltaattr = None
 522     reference = refsam.search(expression="")
 523
 524     for refentry in reference:
 525         entry = sam.search(expression="distinguishedName=%s" % refentry["dn"],
 526                            scope=SCOPE_SUBTREE)
 527         if not len(entry):
 528             delta = sam.msg_diff(empty, refentry)
 529             message(CHANGE, "Adding %s to sam db" % str(refentry.dn))
 530             if str(refentry.dn) == "@PROVISION" and\
 531                     delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 532                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 533             delta.dn = refentry.dn
 534             sam.add(delta)
 535         else:
 536             delta = sam.msg_diff(entry[0], refentry)
 537             if str(refentry.dn) == "@ATTRIBUTES":
 538                 deltaattr = sam.msg_diff(refentry, entry[0])
 539             if str(refentry.dn) == "@PROVISION" and\
 540                     delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 541                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 542             if len(delta.items()) > 1:
 543                 delta.dn = refentry.dn
 544                 sam.modify(delta)
 545
 546     return deltaattr
 547
 548
 549 def construct_existor_expr(attrs):
 550     """Construct a exists or LDAP search expression.
 551
 552     :param attrs: List of attribute on which we want to create the search
 553         expression.
 554     :return: A string representing the expression, if attrs is empty an
 555         empty string is returned
 556     """
 557     expr = ""
 558     if len(attrs) > 0:
 559         expr = "(|"
 560         for att in attrs:
 561             expr = "%s(%s=*)" %(expr, att)
 562         expr = "%s)" %expr
 563     return expr
 564
 565
 566 def update_machine_account_password(samdb, secrets_ldb, names):
 567     """Update (change) the password of the current DC both in the SAM db and in
 568        secret one
 569
 570     :param samdb: An LDB object related to the sam.ldb file of a given provision
 571     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 572                         provision
 573     :param names: List of key provision parameters"""
 574
 575     expression = "samAccountName=%s$" % names.netbiosname
 576     secrets_msg = secrets_ldb.search(expression=expression,
 577                                      attrs=["secureChannelType"])
 578     if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC:
 579         res = samdb.search(expression=expression, attrs=[])
 580         assert(len(res) == 1)
 581
 582         msg = ldb.Message(res[0].dn)
 583         machinepass = samba.generate_random_machine_password(120, 120)
 584         mputf16 = machinepass.encode('utf-16-le')
 585         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 586                                                       ldb.FLAG_MOD_REPLACE,
 587                                                       "clearTextPassword")
 588         samdb.modify(msg)
 589
 590         res = samdb.search(expression=("samAccountName=%s$" % names.netbiosname),
 591                            attrs=["msDs-keyVersionNumber"])
 592         assert(len(res) == 1)
 593         kvno = int(str(res[0]["msDs-keyVersionNumber"]))
 594         secChanType = int(secrets_msg[0]["secureChannelType"][0])
 595
 596         secretsdb_self_join(secrets_ldb, domain=names.domain,
 597                             realm=names.realm,
 598                             domainsid=names.domainsid,
 599                             dnsdomain=names.dnsdomain,
 600                             netbiosname=names.netbiosname,
 601                             machinepass=machinepass,
 602                             key_version_number=kvno,
 603                             secure_channel_type=secChanType)
 604     else:
 605         raise ProvisioningError("Unable to find a Secure Channel"
 606                                 "of type SEC_CHAN_BDC")
 607
 608
 609 def update_dns_account_password(samdb, secrets_ldb, names):
 610     """Update (change) the password of the dns both in the SAM db and in
 611        secret one
 612
 613     :param samdb: An LDB object related to the sam.ldb file of a given provision
 614     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 615                         provision
 616     :param names: List of key provision parameters"""
 617
 618     expression = "samAccountName=dns-%s" % names.netbiosname
 619     secrets_msg = secrets_ldb.search(expression=expression)
 620     if len(secrets_msg) == 1:
 621         res = samdb.search(expression=expression, attrs=[])
 622         assert(len(res) == 1)
 623
 624         msg = ldb.Message(res[0].dn)
 625         machinepass = samba.generate_random_password(128, 255)
 626         mputf16 = machinepass.encode('utf-16-le')
 627         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 628                                                       ldb.FLAG_MOD_REPLACE,
 629                                                       "clearTextPassword")
 630
 631         samdb.modify(msg)
 632
 633         res = samdb.search(expression=expression,
 634                            attrs=["msDs-keyVersionNumber"])
 635         assert(len(res) == 1)
 636         kvno = str(res[0]["msDs-keyVersionNumber"])
 637
 638         msg = ldb.Message(secrets_msg[0].dn)
 639         msg["secret"] = ldb.MessageElement(machinepass,
 640                                            ldb.FLAG_MOD_REPLACE,
 641                                            "secret")
 642         msg["msDS-KeyVersionNumber"] = ldb.MessageElement(kvno,
 643                                                           ldb.FLAG_MOD_REPLACE,
 644                                                           "msDS-KeyVersionNumber")
 645
 646         secrets_ldb.modify(msg)
 647
 648
 649 def update_krbtgt_account_password(samdb):
 650     """Update (change) the password of the krbtgt account
 651
 652     :param samdb: An LDB object related to the sam.ldb file of a given provision"""
 653
 654     expression = "samAccountName=krbtgt"
 655     res = samdb.search(expression=expression, attrs=[])
 656     assert(len(res) == 1)
 657
 658     msg = ldb.Message(res[0].dn)
 659     # Note that the machinepass value is ignored
 660     # as the backend (password_hash.c) will generate its
 661     # own random values for the krbtgt keys
 662     krbtgtpass = samba.generate_random_machine_password(128, 255)
 663     kputf16 = krbtgtpass.encode('utf-16-le')
 664     msg["clearTextPassword"] = ldb.MessageElement(kputf16,
 665                                                   ldb.FLAG_MOD_REPLACE,
 666                                                   "clearTextPassword")
 667
 668     samdb.modify(msg)
 669
 670
 671 def search_constructed_attrs_stored(samdb, rootdn, attrs):
 672     """Search a given sam DB for calculated attributes that are
 673     still stored in the db.
 674
 675     :param samdb: An LDB object pointing to the sam
 676     :param rootdn: The base DN where the search should start
 677     :param attrs: A list of attributes to be searched
 678     :return: A hash with attributes as key and an array of
 679              array. Each array contains the dn and the associated
 680              values for this attribute as they are stored in the
 681              sam."""
 682
 683     hashAtt = {}
 684     expr = construct_existor_expr(attrs)
 685     if expr == "":
 686         return hashAtt
 687     entry = samdb.search(expression=expr, base=ldb.Dn(samdb, str(rootdn)),
 688                          scope=SCOPE_SUBTREE, attrs=attrs,
 689                          controls=["search_options:1:2", "bypassoperational:0"])
 690     if len(entry) == 0:
 691         # Nothing anymore
 692         return hashAtt
 693
 694     for ent in entry:
 695         for att in attrs:
 696             if ent.get(att):
 697                 if att in hashAtt:
 698                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 699                 else:
 700                     hashAtt[att] = {}
 701                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 702
 703     return hashAtt
 704
 705
 706 def findprovisionrange(samdb, basedn):
 707     """ Find ranges of usn grouped by invocation id and then by timestamp
 708         rouned at 1 minute
 709
 710         :param samdb: An LDB object pointing to the samdb
 711         :param basedn: The DN of the forest
 712
 713         :return: A two level dictionary with invoication id as the
 714                 first level, timestamp as the second one and then
 715                 max, min, and number as subkeys, representing respectivily
 716                 the maximum usn for the range, the minimum usn and the number
 717                 of object with usn in this range.
 718     """
 719     nb_obj = 0
 720     hash_id = {}
 721
 722     res = samdb.search(base=basedn, expression="objectClass=*",
 723                        scope=ldb.SCOPE_SUBTREE,
 724                        attrs=["replPropertyMetaData"],
 725                        controls=["search_options:1:2"])
 726
 727     for e in res:
 728         nb_obj = nb_obj + 1
 729         obj = ndr_unpack(drsblobs.replPropertyMetaDataBlob,
 730                          str(e["replPropertyMetaData"])).ctr
 731
 732         for o in obj.array:
 733             # like a timestamp but with the resolution of 1 minute
 734             minutestamp = _glue.nttime2unix(o.originating_change_time) // 60
 735             hash_ts = hash_id.get(str(o.originating_invocation_id))
 736
 737             if hash_ts is None:
 738                 ob = {}
 739                 ob["min"] = o.originating_usn
 740                 ob["max"] = o.originating_usn
 741                 ob["num"] = 1
 742                 ob["list"] = [str(e.dn)]
 743                 hash_ts = {}
 744             else:
 745                 ob = hash_ts.get(minutestamp)
 746                 if ob is None:
 747                     ob = {}
 748                     ob["min"] = o.originating_usn
 749                     ob["max"] = o.originating_usn
 750                     ob["num"] = 1
 751                     ob["list"] = [str(e.dn)]
 752                 else:
 753                     if ob["min"] > o.originating_usn:
 754                         ob["min"] = o.originating_usn
 755                     if ob["max"] < o.originating_usn:
 756                         ob["max"] = o.originating_usn
 757                     if not (str(e.dn) in ob["list"]):
 758                         ob["num"] = ob["num"] + 1
 759                         ob["list"].append(str(e.dn))
 760             hash_ts[minutestamp] = ob
 761             hash_id[str(o.originating_invocation_id)] = hash_ts
 762
 763     return (hash_id, nb_obj)
 764
 765
 766 def print_provision_ranges(dic, limit_print, dest, samdb_path, invocationid):
 767     """ print the differents ranges passed as parameter
 768
 769         :param dic: A dictionary as returned by findprovisionrange
 770         :param limit_print: minimum number of object in a range in order to print it
 771         :param dest: Destination directory
 772         :param samdb_path: Path to the sam.ldb file
 773         :param invoicationid: Invocation ID for the current provision
 774     """
 775     ldif = ""
 776
 777     for id in dic:
 778         hash_ts = dic[id]
 779         sorted_keys = []
 780         sorted_keys.extend(hash_ts.keys())
 781         sorted_keys.sort()
 782
 783         kept_record = []
 784         for k in sorted_keys:
 785             obj = hash_ts[k]
 786             if obj["num"] > limit_print:
 787                 dt = _glue.nttime2string(_glue.unix2nttime(k * 60))
 788                 print("%s # of modification: %d  \tmin: %d max: %d" % (dt, obj["num"],
 789                                                                        obj["min"],
 790                                                                        obj["max"]))
 791             if hash_ts[k]["num"] > 600:
 792                 kept_record.append(k)
 793
 794         # Let's try to concatenate consecutive block if they are in the almost same minutestamp
 795         for i in range(0, len(kept_record)):
 796             if i != 0:
 797                 key1 = kept_record[i]
 798                 key2 = kept_record[i - 1]
 799                 if key1 - key2 == 1:
 800                     # previous record is just 1 minute away from current
 801                     if int(hash_ts[key1]["min"]) == int(hash_ts[key2]["max"]) + 1:
 802                         # Copy the highest USN in the previous record
 803                         # and mark the current as skipped
 804                         hash_ts[key2]["max"] = hash_ts[key1]["max"]
 805                         hash_ts[key1]["skipped"] = True
 806
 807         for k in kept_record:
 808                 obj = hash_ts[k]
 809                 if obj.get("skipped") is None:
 810                     ldif = "%slastProvisionUSN: %d-%d;%s\n" % (ldif, obj["min"],
 811                                                                obj["max"], id)
 812
 813     if ldif != "":
 814         fd, file = tempfile.mkstemp(dir=dest, prefix="usnprov", suffix=".ldif")
 815         print()
 816         print("To track the USNs modified/created by provision and upgrade proivsion,")
 817         print(" the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif)
 818         print("We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file)
 819         print("You can load this file like this: ldbadd -H %s %s\n" %(str(samdb_path), file))
 820         ldif = "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid, ldif)
 821         os.write(fd, ldif)
 822         os.close(fd)
 823
 824
 825 def int64range2str(value):
 826     """Display the int64 range stored in value as xxx-yyy
 827
 828     :param value: The int64 range
 829     :return: A string of the representation of the range
 830     """
 831     lvalue = int(value)
 832     str = "%d-%d" % (lvalue &0xFFFFFFFF, lvalue >>32)
 833     return str