1 # Helpers for provision stuff
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
4 # Based on provision a Samba4 server by
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 """Helpers used for upgrading between different database formats."""
29 from samba
import Ldb
, version
, ntacls
30 from ldb
import SCOPE_SUBTREE
, SCOPE_ONELEVEL
, SCOPE_BASE
32 from samba
.provision
import (provision_paths_from_lp
,
33 getpolicypath
, set_gpos_acl
, create_gpo_struct
,
34 FILL_FULL
, provision
, ProvisioningError
,
35 setsysvolacl
, secretsdb_self_join
)
36 from samba
.dcerpc
import xattr
, drsblobs
37 from samba
.dcerpc
.misc
import SEC_CHAN_BDC
38 from samba
.ndr
import ndr_unpack
39 from samba
.samdb
import SamDB
40 from samba
import _glue
43 # All the ldb related to registry are commented because the path for them is
44 # relative in the provisionPath object
45 # And so opening them create a file in the current directory which is not what
47 # I still keep them commented because I plan soon to make more cleaner
56 hashAttrNotCopied
= set(["dn", "whenCreated", "whenChanged", "objectGUID",
57 "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
58 "objectCategory", "distinguishedName", "nTMixedDomain",
59 "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
60 "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
61 "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
62 "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
63 "possibleInferiors", "privilege", "sAMAccountType"])
66 class ProvisionLDB(object):
79 return (self
.sam
, self
.secrets
, self
.idmap
, self
.privilege
)
81 def startTransactions(self
):
83 db
.transaction_start()
85 # self.hkcr.transaction_start()
86 # self.hkcu.transaction_start()
87 # self.hku.transaction_start()
88 # self.hklm.transaction_start()
90 def groupedRollback(self
):
94 db
.transaction_cancel()
99 # self.hkcr.transaction_cancel()
100 # self.hkcu.transaction_cancel()
101 # self.hku.transaction_cancel()
102 # self.hklm.transaction_cancel()
104 def groupedCommit(self
):
106 for db
in self
.dbs():
107 db
.transaction_prepare_commit()
109 return self
.groupedRollback()
111 # self.hkcr.transaction_prepare_commit()
112 # self.hkcu.transaction_prepare_commit()
113 # self.hku.transaction_prepare_commit()
114 # self.hklm.transaction_prepare_commit()
116 for db
in self
.dbs():
117 db
.transaction_commit()
119 return self
.groupedRollback()
122 # self.hkcr.transaction_commit()
123 # self.hkcu.transaction_commit()
124 # self.hku.transaction_commit()
125 # self.hklm.transaction_commit()
129 def get_ldbs(paths
, creds
, session
, lp
):
130 """Return LDB object mapped on most important databases
132 :param paths: An object holding the different importants paths for provision object
133 :param creds: Credential used for openning LDB files
134 :param session: Session to use for openning LDB files
135 :param lp: A loadparam object
136 :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
138 ldbs
= ProvisionLDB()
140 ldbs
.sam
= SamDB(paths
.samdb
, session_info
=session
, credentials
=creds
, lp
=lp
, options
=["modules:samba_dsdb"])
141 ldbs
.secrets
= Ldb(paths
.secrets
, session_info
=session
, credentials
=creds
, lp
=lp
)
142 ldbs
.idmap
= Ldb(paths
.idmapdb
, session_info
=session
, credentials
=creds
, lp
=lp
)
143 ldbs
.privilege
= Ldb(paths
.privilege
, session_info
=session
, credentials
=creds
, lp
=lp
)
144 # ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
145 # ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
146 # ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
147 # ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
152 def usn_in_range(usn
, range):
153 """Check if the usn is in one of the range provided.
154 To do so, the value is checked to be between the lower bound and
155 higher bound of a range
157 :param usn: A integer value corresponding to the usn that we want to update
158 :param range: A list of integer representing ranges, lower bounds are in
159 the even indices, higher in odd indices
160 :return: True if the usn is in one of the range, False otherwise
167 if idx
== len(range):
170 if usn
< int(range[idx
]):
174 if usn
== int(range[idx
]):
181 def get_paths(param
, targetdir
=None, smbconf
=None):
182 """Get paths to important provision objects (smb.conf, ldb files, ...)
184 :param param: Param object
185 :param targetdir: Directory where the provision is (or will be) stored
186 :param smbconf: Path to the smb.conf file
187 :return: A list with the path of important provision objects"""
188 if targetdir
is not None:
189 if not os
.path
.exists(targetdir
):
191 etcdir
= os
.path
.join(targetdir
, "etc")
192 if not os
.path
.exists(etcdir
):
194 smbconf
= os
.path
.join(etcdir
, "smb.conf")
196 smbconf
= param
.default_path()
198 if not os
.path
.exists(smbconf
):
199 raise ProvisioningError("Unable to find smb.conf")
201 lp
= param
.LoadParm()
203 paths
= provision_paths_from_lp(lp
, lp
.get("realm"))
206 def update_policyids(names
, samdb
):
207 """Update policy ids that could have changed after sam update
209 :param names: List of key provision parameters
210 :param samdb: An Ldb object conntected with the sam DB
213 res
= samdb
.search(expression
="(displayName=Default Domain Policy)",
214 base
="CN=Policies,CN=System," + str(names
.rootdn
),
215 scope
=SCOPE_ONELEVEL
, attrs
=["cn","displayName"])
216 names
.policyid
= str(res
[0]["cn"]).replace("{","").replace("}","")
218 res2
= samdb
.search(expression
="(displayName=Default Domain Controllers"
220 base
="CN=Policies,CN=System," + str(names
.rootdn
),
221 scope
=SCOPE_ONELEVEL
, attrs
=["cn","displayName"])
223 names
.policyid_dc
= str(res2
[0]["cn"]).replace("{","").replace("}","")
225 names
.policyid_dc
= None
228 def newprovision(names
, creds
, session
, smbconf
, provdir
, logger
):
229 """Create a new provision.
231 This provision will be the reference for knowing what has changed in the
232 since the latest upgrade in the current provision
234 :param names: List of provision parameters
235 :param creds: Credentials for the authentification
236 :param session: Session object
237 :param smbconf: Path to the smb.conf file
238 :param provdir: Directory where the provision will be stored
239 :param logger: A Logger
241 if os
.path
.isdir(provdir
):
242 shutil
.rmtree(provdir
)
244 logger
.info("Provision stored in %s", provdir
)
245 return provision(logger
, session
, creds
, smbconf
=smbconf
,
246 targetdir
=provdir
, samdb_fill
=FILL_FULL
, realm
=names
.realm
,
247 domain
=names
.domain
, domainguid
=names
.domainguid
,
248 domainsid
=str(names
.domainsid
), ntdsguid
=names
.ntdsguid
,
249 policyguid
=names
.policyid
, policyguid_dc
=names
.policyid_dc
,
250 hostname
=names
.netbiosname
.lower(), hostip
=None, hostip6
=None,
251 invocationid
=names
.invocation
, adminpass
=names
.adminpass
,
252 krbtgtpass
=None, machinepass
=None, dnspass
=None, root
=None,
253 nobody
=None, users
=None,
254 serverrole
="domain controller",
255 backend_type
=None, ldapadminpass
=None, ol_mmr_urls
=None,
257 dom_for_fun_level
=names
.domainlevel
, dns_backend
=names
.dns_backend
,
258 useeadb
=True, use_ntvfs
=True)
262 """Sorts two DNs in the lexicographical order it and put higher level DN
265 So given the dns cn=bar,cn=foo and cn=foo the later will be return as
268 :param x: First object to compare
269 :param y: Second object to compare
271 p
= re
.compile(r
'(?<!\\), ?')
272 tab1
= p
.split(str(x
))
273 tab2
= p
.split(str(y
))
274 minimum
= min(len(tab1
), len(tab2
))
277 # Note: python range go up to upper limit but do not include it
278 for i
in range(0, minimum
):
279 ret
= cmp(tab1
[len1
-i
], tab2
[len2
-i
])
284 assert len1
!=len2
,"PB PB PB" + " ".join(tab1
)+" / " + " ".join(tab2
)
292 def identic_rename(ldbobj
, dn
):
293 """Perform a back and forth rename to trigger renaming on attribute that
294 can't be directly modified.
296 :param lbdobj: An Ldb Object
297 :param dn: DN of the object to manipulate
299 (before
, after
) = str(dn
).split('=', 1)
300 # we need to use relax to avoid the subtree_rename constraints
301 ldbobj
.rename(dn
, ldb
.Dn(ldbobj
, "%s=foo%s" % (before
, after
)), ["relax:0"])
302 ldbobj
.rename(ldb
.Dn(ldbobj
, "%s=foo%s" % (before
, after
)), dn
, ["relax:0"])
306 """Return separate ACE of an ACL
308 :param acl: A string representing the ACL
309 :return: A hash with different parts
312 p
= re
.compile(r
'(\w+)?(\(.*?\))')
320 hash["aces"].append(e
[1])
325 def chunck_sddl(sddl
):
326 """ Return separate parts of the SDDL (owner, group, ...)
328 :param sddl: An string containing the SDDL to chunk
329 :return: A hash with the different chunk
332 p
= re
.compile(r
'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
333 tab
= p
.findall(sddl
)
349 def get_diff_sds(refsd
, cursd
, domainsid
, checkSacl
= True):
350 """Get the difference between 2 sd
352 This function split the textual representation of ACL into smaller
353 chunck in order to not to report a simple permutation as a difference
355 :param refsddl: First sddl to compare
356 :param cursddl: Second sddl to compare
357 :param checkSacl: If false we skip the sacl checks
358 :return: A string that explain difference between sddls
361 cursddl
= cursd
.as_sddl(domainsid
)
362 refsddl
= refsd
.as_sddl(domainsid
)
365 hash_cur
= chunck_sddl(cursddl
)
366 hash_ref
= chunck_sddl(refsddl
)
368 if not hash_cur
.has_key("owner"):
369 txt
= "\tNo owner in current SD"
370 elif hash_cur
["owner"] != hash_ref
["owner"]:
371 txt
= "\tOwner mismatch: %s (in ref) %s" \
372 "(in current)\n" % (hash_ref
["owner"], hash_cur
["owner"])
374 if not hash_cur
.has_key("group"):
375 txt
= "%s\tNo group in current SD" % txt
376 elif hash_cur
["group"] != hash_ref
["group"]:
377 txt
= "%s\tGroup mismatch: %s (in ref) %s" \
378 "(in current)\n" % (txt
, hash_ref
["group"], hash_cur
["group"])
384 if hash_cur
.has_key(part
) and hash_ref
.has_key(part
):
386 # both are present, check if they contain the same ACE
389 c_cur
= chunck_acl(hash_cur
[part
])
390 c_ref
= chunck_acl(hash_ref
[part
])
392 for elem
in c_cur
["aces"]:
395 for elem
in c_ref
["aces"]:
403 if len(h_cur
) + len(h_ref
) > 0:
404 txt
= "%s\tPart %s is different between reference" \
405 " and current here is the detail:\n" % (txt
, part
)
408 txt
= "%s\t\t%s ACE is not present in the" \
409 " reference\n" % (txt
, item
)
412 txt
= "%s\t\t%s ACE is not present in the" \
413 " current\n" % (txt
, item
)
415 elif hash_cur
.has_key(part
) and not hash_ref
.has_key(part
):
416 txt
= "%s\tReference ACL hasn't a %s part\n" % (txt
, part
)
417 elif not hash_cur
.has_key(part
) and hash_ref
.has_key(part
):
418 txt
= "%s\tCurrent ACL hasn't a %s part\n" % (txt
, part
)
423 def update_secrets(newsecrets_ldb
, secrets_ldb
, messagefunc
):
424 """Update secrets.ldb
426 :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
427 of the reference provision
428 :param secrets_ldb: An LDB object that is connected to the secrets.ldb
429 of the updated provision
432 messagefunc(SIMPLE
, "Update of secrets.ldb")
433 reference
= newsecrets_ldb
.search(base
="@MODULES", scope
=SCOPE_BASE
)
434 current
= secrets_ldb
.search(base
="@MODULES", scope
=SCOPE_BASE
)
435 assert reference
, "Reference modules list can not be empty"
436 if len(current
) == 0:
438 delta
= secrets_ldb
.msg_diff(ldb
.Message(), reference
[0])
439 delta
.dn
= reference
[0].dn
440 secrets_ldb
.add(reference
[0])
442 delta
= secrets_ldb
.msg_diff(current
[0], reference
[0])
443 delta
.dn
= current
[0].dn
444 secrets_ldb
.modify(delta
)
446 reference
= newsecrets_ldb
.search(expression
="objectClass=top", base
="",
447 scope
=SCOPE_SUBTREE
, attrs
=["dn"])
448 current
= secrets_ldb
.search(expression
="objectClass=top", base
="",
449 scope
=SCOPE_SUBTREE
, attrs
=["dn"])
455 empty
= ldb
.Message()
456 for i
in range(0, len(reference
)):
457 hash_new
[str(reference
[i
]["dn"]).lower()] = reference
[i
]["dn"]
459 # Create a hash for speeding the search of existing object in the
461 for i
in range(0, len(current
)):
462 hash[str(current
[i
]["dn"]).lower()] = current
[i
]["dn"]
464 for k
in hash_new
.keys():
465 if not hash.has_key(k
):
466 listMissing
.append(hash_new
[k
])
468 listPresent
.append(hash_new
[k
])
470 for entry
in listMissing
:
471 reference
= newsecrets_ldb
.search(expression
="distinguishedName=%s" % entry
,
472 base
="", scope
=SCOPE_SUBTREE
)
473 current
= secrets_ldb
.search(expression
="distinguishedName=%s" % entry
,
474 base
="", scope
=SCOPE_SUBTREE
)
475 delta
= secrets_ldb
.msg_diff(empty
, reference
[0])
476 for att
in hashAttrNotCopied
:
478 messagefunc(CHANGE
, "Entry %s is missing from secrets.ldb" %
481 messagefunc(CHANGE
, " Adding attribute %s" % att
)
482 delta
.dn
= reference
[0].dn
483 secrets_ldb
.add(delta
)
485 for entry
in listPresent
:
486 reference
= newsecrets_ldb
.search(expression
="distinguishedName=%s" % entry
,
487 base
="", scope
=SCOPE_SUBTREE
)
488 current
= secrets_ldb
.search(expression
="distinguishedName=%s" % entry
, base
="",
490 delta
= secrets_ldb
.msg_diff(current
[0], reference
[0])
491 for att
in hashAttrNotCopied
:
495 messagefunc(CHANGE
, "Found attribute name on %s,"
496 " must rename the DN" % (current
[0].dn
))
497 identic_rename(secrets_ldb
, reference
[0].dn
)
501 for entry
in listPresent
:
502 reference
= newsecrets_ldb
.search(expression
="distinguishedName=%s" % entry
, base
="",
504 current
= secrets_ldb
.search(expression
="distinguishedName=%s" % entry
, base
="",
506 delta
= secrets_ldb
.msg_diff(current
[0], reference
[0])
507 for att
in hashAttrNotCopied
:
510 if att
== "msDS-KeyVersionNumber":
514 "Adding/Changing attribute %s to %s" %
515 (att
, current
[0].dn
))
517 delta
.dn
= current
[0].dn
518 secrets_ldb
.modify(delta
)
520 res2
= secrets_ldb
.search(expression
="(samaccountname=dns)",
521 scope
=SCOPE_SUBTREE
, attrs
=["dn"])
524 messagefunc(SIMPLE
, "Remove old dns account")
525 secrets_ldb
.delete(res2
[0]["dn"])
528 def getOEMInfo(samdb
, rootdn
):
529 """Return OEM Information on the top level Samba4 use to store version
532 :param samdb: An LDB object connect to sam.ldb
533 :param rootdn: Root DN of the domain
534 :return: The content of the field oEMInformation (if any)
536 res
= samdb
.search(expression
="(objectClass=*)", base
=str(rootdn
),
537 scope
=SCOPE_BASE
, attrs
=["dn", "oEMInformation"])
538 if len(res
) > 0 and res
[0].get("oEMInformation"):
539 info
= res
[0]["oEMInformation"]
545 def updateOEMInfo(samdb
, rootdn
):
546 """Update the OEMinfo field to add information about upgrade
548 :param samdb: an LDB object connected to the sam DB
549 :param rootdn: The string representation of the root DN of
550 the provision (ie. DC=...,DC=...)
552 res
= samdb
.search(expression
="(objectClass=*)", base
=rootdn
,
553 scope
=SCOPE_BASE
, attrs
=["dn", "oEMInformation"])
555 if res
[0].get("oEMInformation"):
556 info
= str(res
[0]["oEMInformation"])
559 info
= "%s, upgrade to %s" % (info
, version
)
560 delta
= ldb
.Message()
561 delta
.dn
= ldb
.Dn(samdb
, str(res
[0]["dn"]))
562 delta
["oEMInformation"] = ldb
.MessageElement(info
, ldb
.FLAG_MOD_REPLACE
,
566 def update_gpo(paths
, samdb
, names
, lp
, message
):
567 """Create missing GPO file object if needed
569 dir = getpolicypath(paths
.sysvol
, names
.dnsdomain
, names
.policyid
)
570 if not os
.path
.isdir(dir):
571 create_gpo_struct(dir)
573 if names
.policyid_dc
is None:
574 raise ProvisioningError("Policy ID for Domain controller is missing")
575 dir = getpolicypath(paths
.sysvol
, names
.dnsdomain
, names
.policyid_dc
)
576 if not os
.path
.isdir(dir):
577 create_gpo_struct(dir)
579 def increment_calculated_keyversion_number(samdb
, rootdn
, hashDns
):
580 """For a given hash associating dn and a number, this function will
581 update the replPropertyMetaData of each dn in the hash, so that the
582 calculated value of the msDs-KeyVersionNumber is equal or superior to the
583 one associated to the given dn.
585 :param samdb: An SamDB object pointing to the sam
586 :param rootdn: The base DN where we want to start
587 :param hashDns: A hash with dn as key and number representing the
588 minimum value of msDs-KeyVersionNumber that we want to
591 entry
= samdb
.search(expression
='(objectClass=user)',
592 base
=ldb
.Dn(samdb
,str(rootdn
)),
593 scope
=SCOPE_SUBTREE
, attrs
=["msDs-KeyVersionNumber"],
594 controls
=["search_options:1:2"])
598 raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
601 if hashDns
.has_key(str(e
.dn
).lower()):
602 val
= e
.get("msDs-KeyVersionNumber")
605 version
= int(str(hashDns
[str(e
.dn
).lower()]))
606 if int(str(val
)) < version
:
608 samdb
.set_attribute_replmetadata_version(str(e
.dn
),
611 def delta_update_basesamdb(refsampath
, sampath
, creds
, session
, lp
, message
):
612 """Update the provision container db: sam.ldb
613 This function is aimed for alpha9 and newer;
615 :param refsampath: Path to the samdb in the reference provision
616 :param sampath: Path to the samdb in the upgraded provision
617 :param creds: Credential used for openning LDB files
618 :param session: Session to use for openning LDB files
619 :param lp: A loadparam object
620 :return: A msg_diff object with the difference between the @ATTRIBUTES
621 of the current provision and the reference provision
625 "Update base samdb by searching difference with reference one")
626 refsam
= Ldb(refsampath
, session_info
=session
, credentials
=creds
,
627 lp
=lp
, options
=["modules:"])
628 sam
= Ldb(sampath
, session_info
=session
, credentials
=creds
, lp
=lp
,
629 options
=["modules:"])
631 empty
= ldb
.Message()
633 reference
= refsam
.search(expression
="")
635 for refentry
in reference
:
636 entry
= sam
.search(expression
="distinguishedName=%s" % refentry
["dn"],
639 delta
= sam
.msg_diff(empty
, refentry
)
640 message(CHANGE
, "Adding %s to sam db" % str(refentry
.dn
))
641 if str(refentry
.dn
) == "@PROVISION" and\
642 delta
.get(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
):
643 delta
.remove(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
)
644 delta
.dn
= refentry
.dn
647 delta
= sam
.msg_diff(entry
[0], refentry
)
648 if str(refentry
.dn
) == "@ATTRIBUTES":
649 deltaattr
= sam
.msg_diff(refentry
, entry
[0])
650 if str(refentry
.dn
) == "@PROVISION" and\
651 delta
.get(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
):
652 delta
.remove(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
)
653 if len(delta
.items()) > 1:
654 delta
.dn
= refentry
.dn
660 def construct_existor_expr(attrs
):
661 """Construct a exists or LDAP search expression.
663 :param attrs: List of attribute on which we want to create the search
665 :return: A string representing the expression, if attrs is empty an
666 empty string is returned
672 expr
= "%s(%s=*)"%(expr
,att
)
676 def update_machine_account_password(samdb
, secrets_ldb
, names
):
677 """Update (change) the password of the current DC both in the SAM db and in
680 :param samdb: An LDB object related to the sam.ldb file of a given provision
681 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
683 :param names: List of key provision parameters"""
685 expression
= "samAccountName=%s$" % names
.netbiosname
686 secrets_msg
= secrets_ldb
.search(expression
=expression
,
687 attrs
=["secureChannelType"])
688 if int(secrets_msg
[0]["secureChannelType"][0]) == SEC_CHAN_BDC
:
689 res
= samdb
.search(expression
=expression
, attrs
=[])
690 assert(len(res
) == 1)
692 msg
= ldb
.Message(res
[0].dn
)
693 machinepass
= samba
.generate_random_password(128, 255)
694 mputf16
= machinepass
.encode('utf-16-le')
695 msg
["clearTextPassword"] = ldb
.MessageElement(mputf16
,
696 ldb
.FLAG_MOD_REPLACE
,
700 res
= samdb
.search(expression
=("samAccountName=%s$" % names
.netbiosname
),
701 attrs
=["msDs-keyVersionNumber"])
702 assert(len(res
) == 1)
703 kvno
= int(str(res
[0]["msDs-keyVersionNumber"]))
704 secChanType
= int(secrets_msg
[0]["secureChannelType"][0])
706 secretsdb_self_join(secrets_ldb
, domain
=names
.domain
,
708 domainsid
=names
.domainsid
,
709 dnsdomain
=names
.dnsdomain
,
710 netbiosname
=names
.netbiosname
,
711 machinepass
=machinepass
,
712 key_version_number
=kvno
,
713 secure_channel_type
=secChanType
)
715 raise ProvisioningError("Unable to find a Secure Channel"
716 "of type SEC_CHAN_BDC")
718 def update_dns_account_password(samdb
, secrets_ldb
, names
):
719 """Update (change) the password of the dns both in the SAM db and in
722 :param samdb: An LDB object related to the sam.ldb file of a given provision
723 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
725 :param names: List of key provision parameters"""
727 expression
= "samAccountName=dns-%s" % names
.netbiosname
728 secrets_msg
= secrets_ldb
.search(expression
=expression
)
729 if len(secrets_msg
) == 1:
730 res
= samdb
.search(expression
=expression
, attrs
=[])
731 assert(len(res
) == 1)
733 msg
= ldb
.Message(res
[0].dn
)
734 machinepass
= samba
.generate_random_password(128, 255)
735 mputf16
= machinepass
.encode('utf-16-le')
736 msg
["clearTextPassword"] = ldb
.MessageElement(mputf16
,
737 ldb
.FLAG_MOD_REPLACE
,
742 res
= samdb
.search(expression
=expression
,
743 attrs
=["msDs-keyVersionNumber"])
744 assert(len(res
) == 1)
745 kvno
= str(res
[0]["msDs-keyVersionNumber"])
747 msg
= ldb
.Message(secrets_msg
[0].dn
)
748 msg
["secret"] = ldb
.MessageElement(machinepass
,
749 ldb
.FLAG_MOD_REPLACE
,
751 msg
["msDS-KeyVersionNumber"] = ldb
.MessageElement(kvno
,
752 ldb
.FLAG_MOD_REPLACE
,
753 "msDS-KeyVersionNumber")
755 secrets_ldb
.modify(msg
)
757 def search_constructed_attrs_stored(samdb
, rootdn
, attrs
):
758 """Search a given sam DB for calculated attributes that are
759 still stored in the db.
761 :param samdb: An LDB object pointing to the sam
762 :param rootdn: The base DN where the search should start
763 :param attrs: A list of attributes to be searched
764 :return: A hash with attributes as key and an array of
765 array. Each array contains the dn and the associated
766 values for this attribute as they are stored in the
770 expr
= construct_existor_expr(attrs
)
773 entry
= samdb
.search(expression
=expr
, base
=ldb
.Dn(samdb
, str(rootdn
)),
774 scope
=SCOPE_SUBTREE
, attrs
=attrs
,
775 controls
=["search_options:1:2","bypassoperational:0"])
783 if hashAtt
.has_key(att
):
784 hashAtt
[att
][str(ent
.dn
).lower()] = str(ent
[att
])
787 hashAtt
[att
][str(ent
.dn
).lower()] = str(ent
[att
])
791 def findprovisionrange(samdb
, basedn
):
792 """ Find ranges of usn grouped by invocation id and then by timestamp
795 :param samdb: An LDB object pointing to the samdb
796 :param basedn: The DN of the forest
798 :return: A two level dictionary with invoication id as the
799 first level, timestamp as the second one and then
800 max, min, and number as subkeys, representing respectivily
801 the maximum usn for the range, the minimum usn and the number
802 of object with usn in this range.
807 res
= samdb
.search(base
=basedn
, expression
="objectClass=*",
808 scope
=ldb
.SCOPE_SUBTREE
,
809 attrs
=["replPropertyMetaData"],
810 controls
=["search_options:1:2"])
814 obj
= ndr_unpack(drsblobs
.replPropertyMetaDataBlob
,
815 str(e
["replPropertyMetaData"])).ctr
818 # like a timestamp but with the resolution of 1 minute
819 minutestamp
=_glue
.nttime2unix(o
.originating_change_time
)/60
820 hash_ts
= hash_id
.get(str(o
.originating_invocation_id
))
824 ob
["min"] = o
.originating_usn
825 ob
["max"] = o
.originating_usn
827 ob
["list"] = [str(e
.dn
)]
830 ob
= hash_ts
.get(minutestamp
)
833 ob
["min"] = o
.originating_usn
834 ob
["max"] = o
.originating_usn
836 ob
["list"] = [str(e
.dn
)]
838 if ob
["min"] > o
.originating_usn
:
839 ob
["min"] = o
.originating_usn
840 if ob
["max"] < o
.originating_usn
:
841 ob
["max"] = o
.originating_usn
842 if not (str(e
.dn
) in ob
["list"]):
843 ob
["num"] = ob
["num"] + 1
844 ob
["list"].append(str(e
.dn
))
845 hash_ts
[minutestamp
] = ob
846 hash_id
[str(o
.originating_invocation_id
)] = hash_ts
848 return (hash_id
, nb_obj
)
850 def print_provision_ranges(dic
, limit_print
, dest
, samdb_path
, invocationid
):
851 """ print the differents ranges passed as parameter
853 :param dic: A dictionnary as returned by findprovisionrange
854 :param limit_print: minimum number of object in a range in order to print it
855 :param dest: Destination directory
856 :param samdb_path: Path to the sam.ldb file
857 :param invoicationid: Invocation ID for the current provision
864 sorted_keys
.extend(hash_ts
.keys())
868 for k
in sorted_keys
:
870 if obj
["num"] > limit_print
:
871 dt
= _glue
.nttime2string(_glue
.unix2nttime(k
*60))
872 print "%s # of modification: %d \tmin: %d max: %d" % (dt
, obj
["num"],
875 if hash_ts
[k
]["num"] > 600:
876 kept_record
.append(k
)
878 # Let's try to concatenate consecutive block if they are in the almost same minutestamp
879 for i
in range(0, len(kept_record
)):
881 key1
= kept_record
[i
]
882 key2
= kept_record
[i
-1]
884 # previous record is just 1 minute away from current
885 if int(hash_ts
[key1
]["min"]) == int(hash_ts
[key2
]["max"]) + 1:
886 # Copy the highest USN in the previous record
887 # and mark the current as skipped
888 hash_ts
[key2
]["max"] = hash_ts
[key1
]["max"]
889 hash_ts
[key1
]["skipped"] = True
891 for k
in kept_record
:
893 if obj
.get("skipped") is None:
894 ldif
= "%slastProvisionUSN: %d-%d;%s\n" % (ldif
, obj
["min"],
898 file = tempfile
.mktemp(dir=dest
, prefix
="usnprov", suffix
=".ldif")
900 print "To track the USNs modified/created by provision and upgrade proivsion,"
901 print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
902 print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
903 print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path
),file)
904 ldif
= "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid
, ldif
)
905 open(file,'w').write(ldif
)
907 def int64range2str(value
):
908 """Display the int64 range stored in value as xxx-yyy
910 :param value: The int64 range
911 :return: A string of the representation of the range
915 str = "%d-%d" % (lvalue
&0xFFFFFFFF, lvalue
>>32)