python/samba/upgradehelpers.py

   1 # Helpers for provision stuff
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
   3 #
   4 # Based on provision a Samba4 server by
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 """Helpers used for upgrading between different database formats."""
  23
  24 import os
  25 import re
  26 import shutil
  27 import samba
  28
  29 from samba import Ldb, version, ntacls
  30 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
  31 import ldb
  32 from samba.provision import (provision_paths_from_lp,
  33                             getpolicypath, set_gpos_acl, create_gpo_struct,
  34                             FILL_FULL, provision, ProvisioningError,
  35                             setsysvolacl, secretsdb_self_join)
  36 from samba.dcerpc import xattr, drsblobs, security
  37 from samba.dcerpc.misc import SEC_CHAN_BDC
  38 from samba.ndr import ndr_unpack
  39 from samba.samdb import SamDB
  40 from samba import _glue
  41 import tempfile
  42
  43 # All the ldb related to registry are commented because the path for them is
  44 # relative in the provisionPath object
  45 # And so opening them create a file in the current directory which is not what
  46 # we want
  47 # I still keep them commented because I plan soon to make more cleaner
  48 ERROR =     -1
  49 SIMPLE =     0x00
  50 CHANGE =     0x01
  51 CHANGESD =     0x02
  52 GUESS =     0x04
  53 PROVISION =    0x08
  54 CHANGEALL =    0xff
  55
  56 hashAttrNotCopied = set(["dn", "whenCreated", "whenChanged", "objectGUID",
  57     "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
  58     "objectCategory", "distinguishedName", "nTMixedDomain",
  59     "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
  60     "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
  61     "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
  62     "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
  63     "possibleInferiors", "privilege", "sAMAccountType"])
  64
  65
  66 class ProvisionLDB(object):
  67
  68     def __init__(self):
  69         self.sam = None
  70         self.secrets = None
  71         self.idmap = None
  72         self.privilege = None
  73         self.hkcr = None
  74         self.hkcu = None
  75         self.hku = None
  76         self.hklm = None
  77
  78     def dbs(self):
  79         return (self.sam, self.secrets, self.idmap, self.privilege)
  80
  81     def startTransactions(self):
  82         for db in self.dbs():
  83             db.transaction_start()
  84 # TO BE DONE
  85 #        self.hkcr.transaction_start()
  86 #        self.hkcu.transaction_start()
  87 #        self.hku.transaction_start()
  88 #        self.hklm.transaction_start()
  89
  90     def groupedRollback(self):
  91         ok = True
  92         for db in self.dbs():
  93             try:
  94                 db.transaction_cancel()
  95             except Exception:
  96                 ok = False
  97         return ok
  98 # TO BE DONE
  99 #        self.hkcr.transaction_cancel()
 100 #        self.hkcu.transaction_cancel()
 101 #        self.hku.transaction_cancel()
 102 #        self.hklm.transaction_cancel()
 103
 104     def groupedCommit(self):
 105         try:
 106             for db in self.dbs():
 107                 db.transaction_prepare_commit()
 108         except Exception:
 109             return self.groupedRollback()
 110 # TO BE DONE
 111 #        self.hkcr.transaction_prepare_commit()
 112 #        self.hkcu.transaction_prepare_commit()
 113 #        self.hku.transaction_prepare_commit()
 114 #        self.hklm.transaction_prepare_commit()
 115         try:
 116             for db in self.dbs():
 117                 db.transaction_commit()
 118         except Exception:
 119             return self.groupedRollback()
 120
 121 # TO BE DONE
 122 #        self.hkcr.transaction_commit()
 123 #        self.hkcu.transaction_commit()
 124 #        self.hku.transaction_commit()
 125 #        self.hklm.transaction_commit()
 126         return True
 127
 128
 129 def get_ldbs(paths, creds, session, lp):
 130     """Return LDB object mapped on most important databases
 131
 132     :param paths: An object holding the different importants paths for provision object
 133     :param creds: Credential used for openning LDB files
 134     :param session: Session to use for openning LDB files
 135     :param lp: A loadparam object
 136     :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
 137
 138     ldbs = ProvisionLDB()
 139
 140     ldbs.sam = SamDB(paths.samdb, session_info=session, credentials=creds, lp=lp, options=["modules:samba_dsdb"])
 141     ldbs.secrets = Ldb(paths.secrets, session_info=session, credentials=creds, lp=lp)
 142     ldbs.idmap = Ldb(paths.idmapdb, session_info=session, credentials=creds, lp=lp)
 143     ldbs.privilege = Ldb(paths.privilege, session_info=session, credentials=creds, lp=lp)
 144 #    ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
 145 #    ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
 146 #    ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
 147 #    ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
 148
 149     return ldbs
 150
 151
 152 def usn_in_range(usn, range):
 153     """Check if the usn is in one of the range provided.
 154     To do so, the value is checked to be between the lower bound and
 155     higher bound of a range
 156
 157     :param usn: A integer value corresponding to the usn that we want to update
 158     :param range: A list of integer representing ranges, lower bounds are in
 159                   the even indices, higher in odd indices
 160     :return: True if the usn is in one of the range, False otherwise
 161     """
 162
 163     idx = 0
 164     cont = True
 165     ok = False
 166     while cont:
 167         if idx ==  len(range):
 168             cont = False
 169             continue
 170         if usn < int(range[idx]):
 171             if idx %2 == 1:
 172                 ok = True
 173             cont = False
 174         if usn == int(range[idx]):
 175             cont = False
 176             ok = True
 177         idx = idx + 1
 178     return ok
 179
 180
 181 def get_paths(param, targetdir=None, smbconf=None):
 182     """Get paths to important provision objects (smb.conf, ldb files, ...)
 183
 184     :param param: Param object
 185     :param targetdir: Directory where the provision is (or will be) stored
 186     :param smbconf: Path to the smb.conf file
 187     :return: A list with the path of important provision objects"""
 188     if targetdir is not None:
 189         if not os.path.exists(targetdir):
 190             os.mkdir(targetdir)
 191         etcdir = os.path.join(targetdir, "etc")
 192         if not os.path.exists(etcdir):
 193             os.makedirs(etcdir)
 194         smbconf = os.path.join(etcdir, "smb.conf")
 195     if smbconf is None:
 196         smbconf = param.default_path()
 197
 198     if not os.path.exists(smbconf):
 199         raise ProvisioningError("Unable to find smb.conf")
 200
 201     lp = param.LoadParm()
 202     lp.load(smbconf)
 203     paths = provision_paths_from_lp(lp, lp.get("realm"))
 204     return paths
 205
 206 def update_policyids(names, samdb):
 207     """Update policy ids that could have changed after sam update
 208
 209     :param names: List of key provision parameters
 210     :param samdb: An Ldb object conntected with the sam DB
 211     """
 212     # policy guid
 213     res = samdb.search(expression="(displayName=Default Domain Policy)",
 214                         base="CN=Policies,CN=System," + str(names.rootdn),
 215                         scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
 216     names.policyid = str(res[0]["cn"]).replace("{","").replace("}","")
 217     # dc policy guid
 218     res2 = samdb.search(expression="(displayName=Default Domain Controllers"
 219                                    " Policy)",
 220                             base="CN=Policies,CN=System," + str(names.rootdn),
 221                             scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
 222     if len(res2) == 1:
 223         names.policyid_dc = str(res2[0]["cn"]).replace("{","").replace("}","")
 224     else:
 225         names.policyid_dc = None
 226
 227
 228 def newprovision(names, creds, session, smbconf, provdir, logger):
 229     """Create a new provision.
 230
 231     This provision will be the reference for knowing what has changed in the
 232     since the latest upgrade in the current provision
 233
 234     :param names: List of provision parameters
 235     :param creds: Credentials for the authentification
 236     :param session: Session object
 237     :param smbconf: Path to the smb.conf file
 238     :param provdir: Directory where the provision will be stored
 239     :param logger: A Logger
 240     """
 241     if os.path.isdir(provdir):
 242         shutil.rmtree(provdir)
 243     os.mkdir(provdir)
 244     logger.info("Provision stored in %s", provdir)
 245     return provision(logger, session, creds, smbconf=smbconf,
 246             targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm,
 247             domain=names.domain, domainguid=names.domainguid,
 248             domainsid=str(names.domainsid), ntdsguid=names.ntdsguid,
 249             policyguid=names.policyid, policyguid_dc=names.policyid_dc,
 250             hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
 251             invocationid=names.invocation, adminpass=names.adminpass,
 252             krbtgtpass=None, machinepass=None, dnspass=None, root=None,
 253             nobody=None, users=None,
 254             serverrole="domain controller",
 255             backend_type=None, ldapadminpass=None, ol_mmr_urls=None,
 256             slapd_path=None,
 257             dom_for_fun_level=names.domainlevel, dns_backend=names.dns_backend,
 258             useeadb=True, use_ntvfs=True)
 259
 260
 261 def dn_sort(x, y):
 262     """Sorts two DNs in the lexicographical order it and put higher level DN
 263     before.
 264
 265     So given the dns cn=bar,cn=foo and cn=foo the later will be return as
 266     smaller
 267
 268     :param x: First object to compare
 269     :param y: Second object to compare
 270     """
 271     p = re.compile(r'(?<!\\), ?')
 272     tab1 = p.split(str(x))
 273     tab2 = p.split(str(y))
 274     minimum = min(len(tab1), len(tab2))
 275     len1 = len(tab1)-1
 276     len2 = len(tab2)-1
 277     # Note: python range go up to upper limit but do not include it
 278     for i in range(0, minimum):
 279         ret = cmp(tab1[len1-i], tab2[len2-i])
 280         if ret != 0:
 281             return ret
 282         else:
 283             if i == minimum-1:
 284                 assert len1!=len2,"PB PB PB" + " ".join(tab1)+" / " + " ".join(tab2)
 285                 if len1 > len2:
 286                     return 1
 287                 else:
 288                     return -1
 289     return ret
 290
 291
 292 def identic_rename(ldbobj, dn):
 293     """Perform a back and forth rename to trigger renaming on attribute that
 294     can't be directly modified.
 295
 296     :param lbdobj: An Ldb Object
 297     :param dn: DN of the object to manipulate
 298     """
 299     (before, after) = str(dn).split('=', 1)
 300     # we need to use relax to avoid the subtree_rename constraints
 301     ldbobj.rename(dn, ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), ["relax:0"])
 302     ldbobj.rename(ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), dn, ["relax:0"])
 303
 304
 305 def chunck_acl(acl):
 306     """Return separate ACE of an ACL
 307
 308     :param acl: A string representing the ACL
 309     :return: A hash with different parts
 310     """
 311
 312     p = re.compile(r'(\w+)?(\(.*?\))')
 313     tab = p.findall(acl)
 314
 315     hash = {}
 316     hash["aces"] = []
 317     for e in tab:
 318         if len(e[0]) > 0:
 319             hash["flags"] = e[0]
 320         hash["aces"].append(e[1])
 321
 322     return hash
 323
 324
 325 def chunck_sddl(sddl):
 326     """ Return separate parts of the SDDL (owner, group, ...)
 327
 328     :param sddl: An string containing the SDDL to chunk
 329     :return: A hash with the different chunk
 330     """
 331
 332     p = re.compile(r'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
 333     tab = p.findall(sddl)
 334
 335     hash = {}
 336     for e in tab:
 337         if e[0] == "O:":
 338             hash["owner"] = e[1]
 339         if e[0] == "G:":
 340             hash["group"] = e[1]
 341         if e[0] == "D:":
 342             hash["dacl"] = e[1]
 343         if e[0] == "S:":
 344             hash["sacl"] = e[1]
 345
 346     return hash
 347
 348
 349 def get_clean_sd(sd):
 350     """Get the SD without difference between 2 sddl
 351
 352     This function split the textual representation of ACL into smaller
 353     chunck in order to not to report a simple permutation as a difference
 354
 355     :param refsddl: First sddl to compare
 356     :param cursddl: Second sddl to compare
 357     :param checkSacl: If false we skip the sacl checks
 358     :return: A string that explain difference between sddls
 359     """
 360
 361     sd_clean = security.descriptor()
 362     sd_clean.owner_sid = sd.owner_sid
 363     sd_clean.group_sid = sd.group_sid
 364     sd_clean.type = sd.type
 365     sd_clean.revision = sd.revision
 366
 367     aces = []
 368     if sd.sacl is not None:
 369         aces = sd.sacl.aces
 370     for i in range(0, len(aces)):
 371         ace = aces[i]
 372
 373         if not ace.flags & security.SEC_ACE_FLAG_INHERITED_ACE:
 374             sd_clean.sacl_add(ace)
 375             continue
 376
 377     aces = []
 378     if sd.dacl is not None:
 379         aces = sd.dacl.aces
 380     for i in range(0, len(aces)):
 381         ace = aces[i]
 382
 383         if not ace.flags & security.SEC_ACE_FLAG_INHERITED_ACE:
 384             sd_clean.dacl_add(ace)
 385             continue
 386     return sd_clean
 387
 388
 389 def get_diff_sds(refsd, cursd, domainsid, checkSacl = True):
 390     """Get the difference between 2 sd
 391
 392     This function split the textual representation of ACL into smaller
 393     chunck in order to not to report a simple permutation as a difference
 394
 395     :param refsddl: First sddl to compare
 396     :param cursddl: Second sddl to compare
 397     :param checkSacl: If false we skip the sacl checks
 398     :return: A string that explain difference between sddls
 399     """
 400
 401     cursddl = get_clean_sd(cursd).as_sddl(domainsid)
 402     refsddl = get_clean_sd(refsd).as_sddl(domainsid)
 403
 404     txt = ""
 405     hash_cur = chunck_sddl(cursddl)
 406     hash_ref = chunck_sddl(refsddl)
 407
 408     if not hash_cur.has_key("owner"):
 409         txt = "\tNo owner in current SD"
 410     elif hash_cur["owner"] != hash_ref["owner"]:
 411         txt = "\tOwner mismatch: %s (in ref) %s" \
 412               "(in current)\n" % (hash_ref["owner"], hash_cur["owner"])
 413
 414     if not hash_cur.has_key("group"):
 415         txt = "%s\tNo group in current SD" % txt
 416     elif hash_cur["group"] != hash_ref["group"]:
 417         txt = "%s\tGroup mismatch: %s (in ref) %s" \
 418               "(in current)\n" % (txt, hash_ref["group"], hash_cur["group"])
 419
 420     parts = [ "dacl" ]
 421     if checkSacl:
 422         parts.append("sacl")
 423     for part in parts:
 424         if hash_cur.has_key(part) and hash_ref.has_key(part):
 425
 426             # both are present, check if they contain the same ACE
 427             h_cur = set()
 428             h_ref = set()
 429             c_cur = chunck_acl(hash_cur[part])
 430             c_ref = chunck_acl(hash_ref[part])
 431
 432             for elem in c_cur["aces"]:
 433                 h_cur.add(elem)
 434
 435             for elem in c_ref["aces"]:
 436                 h_ref.add(elem)
 437
 438             for k in set(h_ref):
 439                 if k in h_cur:
 440                     h_cur.remove(k)
 441                     h_ref.remove(k)
 442
 443             if len(h_cur) + len(h_ref) > 0:
 444                 txt = "%s\tPart %s is different between reference" \
 445                       " and current here is the detail:\n" % (txt, part)
 446
 447                 for item in h_cur:
 448                     txt = "%s\t\t%s ACE is not present in the" \
 449                           " reference\n" % (txt, item)
 450
 451                 for item in h_ref:
 452                     txt = "%s\t\t%s ACE is not present in the" \
 453                           " current\n" % (txt, item)
 454
 455         elif hash_cur.has_key(part) and not hash_ref.has_key(part):
 456             txt = "%s\tReference ACL hasn't a %s part\n" % (txt, part)
 457         elif not hash_cur.has_key(part) and hash_ref.has_key(part):
 458             txt = "%s\tCurrent ACL hasn't a %s part\n" % (txt, part)
 459
 460     return txt
 461
 462
 463 def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
 464     """Update secrets.ldb
 465
 466     :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
 467         of the reference provision
 468     :param secrets_ldb: An LDB object that is connected to the secrets.ldb
 469         of the updated provision
 470     """
 471
 472     messagefunc(SIMPLE, "Update of secrets.ldb")
 473     reference = newsecrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 474     current = secrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 475     assert reference, "Reference modules list can not be empty"
 476     if len(current) == 0:
 477         # No modules present
 478         delta = secrets_ldb.msg_diff(ldb.Message(), reference[0])
 479         delta.dn = reference[0].dn
 480         secrets_ldb.add(reference[0])
 481     else:
 482         delta = secrets_ldb.msg_diff(current[0], reference[0])
 483         delta.dn = current[0].dn
 484         secrets_ldb.modify(delta)
 485
 486     reference = newsecrets_ldb.search(expression="objectClass=top", base="",
 487                                         scope=SCOPE_SUBTREE, attrs=["dn"])
 488     current = secrets_ldb.search(expression="objectClass=top", base="",
 489                                         scope=SCOPE_SUBTREE, attrs=["dn"])
 490     hash_new = {}
 491     hash = {}
 492     listMissing = []
 493     listPresent = []
 494
 495     empty = ldb.Message()
 496     for i in range(0, len(reference)):
 497         hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"]
 498
 499     # Create a hash for speeding the search of existing object in the
 500     # current provision
 501     for i in range(0, len(current)):
 502         hash[str(current[i]["dn"]).lower()] = current[i]["dn"]
 503
 504     for k in hash_new.keys():
 505         if not hash.has_key(k):
 506             listMissing.append(hash_new[k])
 507         else:
 508             listPresent.append(hash_new[k])
 509
 510     for entry in listMissing:
 511         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 512                                             base="", scope=SCOPE_SUBTREE)
 513         current = secrets_ldb.search(expression="distinguishedName=%s" % entry,
 514                                             base="", scope=SCOPE_SUBTREE)
 515         delta = secrets_ldb.msg_diff(empty, reference[0])
 516         for att in hashAttrNotCopied:
 517             delta.remove(att)
 518         messagefunc(CHANGE, "Entry %s is missing from secrets.ldb" %
 519                     reference[0].dn)
 520         for att in delta:
 521             messagefunc(CHANGE, " Adding attribute %s" % att)
 522         delta.dn = reference[0].dn
 523         secrets_ldb.add(delta)
 524
 525     for entry in listPresent:
 526         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 527                                             base="", scope=SCOPE_SUBTREE)
 528         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 529                                             scope=SCOPE_SUBTREE)
 530         delta = secrets_ldb.msg_diff(current[0], reference[0])
 531         for att in hashAttrNotCopied:
 532             delta.remove(att)
 533         for att in delta:
 534             if att == "name":
 535                 messagefunc(CHANGE, "Found attribute name on  %s,"
 536                                     " must rename the DN" % (current[0].dn))
 537                 identic_rename(secrets_ldb, reference[0].dn)
 538             else:
 539                 delta.remove(att)
 540
 541     for entry in listPresent:
 542         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 543                                             scope=SCOPE_SUBTREE)
 544         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 545                                             scope=SCOPE_SUBTREE)
 546         delta = secrets_ldb.msg_diff(current[0], reference[0])
 547         for att in hashAttrNotCopied:
 548             delta.remove(att)
 549         for att in delta:
 550             if att == "msDS-KeyVersionNumber":
 551                 delta.remove(att)
 552             if att != "dn":
 553                 messagefunc(CHANGE,
 554                             "Adding/Changing attribute %s to %s" %
 555                             (att, current[0].dn))
 556
 557         delta.dn = current[0].dn
 558         secrets_ldb.modify(delta)
 559
 560     res2 = secrets_ldb.search(expression="(samaccountname=dns)",
 561                                 scope=SCOPE_SUBTREE, attrs=["dn"])
 562
 563     if len(res2) == 1:
 564             messagefunc(SIMPLE, "Remove old dns account")
 565             secrets_ldb.delete(res2[0]["dn"])
 566
 567
 568 def getOEMInfo(samdb, rootdn):
 569     """Return OEM Information on the top level Samba4 use to store version
 570     info in this field
 571
 572     :param samdb: An LDB object connect to sam.ldb
 573     :param rootdn: Root DN of the domain
 574     :return: The content of the field oEMInformation (if any)
 575     """
 576     res = samdb.search(expression="(objectClass=*)", base=str(rootdn),
 577                             scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 578     if len(res) > 0 and res[0].get("oEMInformation"):
 579         info = res[0]["oEMInformation"]
 580         return info
 581     else:
 582         return ""
 583
 584
 585 def updateOEMInfo(samdb, rootdn):
 586     """Update the OEMinfo field to add information about upgrade
 587
 588     :param samdb: an LDB object connected to the sam DB
 589     :param rootdn: The string representation of the root DN of
 590         the provision (ie. DC=...,DC=...)
 591     """
 592     res = samdb.search(expression="(objectClass=*)", base=rootdn,
 593                             scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 594     if len(res) > 0:
 595         if res[0].get("oEMInformation"):
 596             info = str(res[0]["oEMInformation"])
 597         else:
 598             info = ""
 599         info = "%s, upgrade to %s" % (info, version)
 600         delta = ldb.Message()
 601         delta.dn = ldb.Dn(samdb, str(res[0]["dn"]))
 602         delta["oEMInformation"] = ldb.MessageElement(info, ldb.FLAG_MOD_REPLACE,
 603                                                         "oEMInformation" )
 604         samdb.modify(delta)
 605
 606 def update_gpo(paths, samdb, names, lp, message):
 607     """Create missing GPO file object if needed
 608     """
 609     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid)
 610     if not os.path.isdir(dir):
 611         create_gpo_struct(dir)
 612
 613     if names.policyid_dc is None:
 614         raise ProvisioningError("Policy ID for Domain controller is missing")
 615     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
 616     if not os.path.isdir(dir):
 617         create_gpo_struct(dir)
 618
 619 def increment_calculated_keyversion_number(samdb, rootdn, hashDns):
 620     """For a given hash associating dn and a number, this function will
 621     update the replPropertyMetaData of each dn in the hash, so that the
 622     calculated value of the msDs-KeyVersionNumber is equal or superior to the
 623     one associated to the given dn.
 624
 625     :param samdb: An SamDB object pointing to the sam
 626     :param rootdn: The base DN where we want to start
 627     :param hashDns: A hash with dn as key and number representing the
 628                  minimum value of msDs-KeyVersionNumber that we want to
 629                  have
 630     """
 631     entry = samdb.search(expression='(objectClass=user)',
 632                          base=ldb.Dn(samdb,str(rootdn)),
 633                          scope=SCOPE_SUBTREE, attrs=["msDs-KeyVersionNumber"],
 634                          controls=["search_options:1:2"])
 635     done = 0
 636     hashDone = {}
 637     if len(entry) == 0:
 638         raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
 639     else:
 640         for e in entry:
 641             if hashDns.has_key(str(e.dn).lower()):
 642                 val = e.get("msDs-KeyVersionNumber")
 643                 if not val:
 644                     val = "0"
 645                 version = int(str(hashDns[str(e.dn).lower()]))
 646                 if int(str(val)) < version:
 647                     done = done + 1
 648                     samdb.set_attribute_replmetadata_version(str(e.dn),
 649                                                               "unicodePwd",
 650                                                               version, True)
 651 def delta_update_basesamdb(refsampath, sampath, creds, session, lp, message):
 652     """Update the provision container db: sam.ldb
 653     This function is aimed for alpha9 and newer;
 654
 655     :param refsampath: Path to the samdb in the reference provision
 656     :param sampath: Path to the samdb in the upgraded provision
 657     :param creds: Credential used for openning LDB files
 658     :param session: Session to use for openning LDB files
 659     :param lp: A loadparam object
 660     :return: A msg_diff object with the difference between the @ATTRIBUTES
 661              of the current provision and the reference provision
 662     """
 663
 664     message(SIMPLE,
 665             "Update base samdb by searching difference with reference one")
 666     refsam = Ldb(refsampath, session_info=session, credentials=creds,
 667                     lp=lp, options=["modules:"])
 668     sam = Ldb(sampath, session_info=session, credentials=creds, lp=lp,
 669                 options=["modules:"])
 670
 671     empty = ldb.Message()
 672     deltaattr = None
 673     reference = refsam.search(expression="")
 674
 675     for refentry in reference:
 676         entry = sam.search(expression="distinguishedName=%s" % refentry["dn"],
 677                             scope=SCOPE_SUBTREE)
 678         if not len(entry):
 679             delta = sam.msg_diff(empty, refentry)
 680             message(CHANGE, "Adding %s to sam db" % str(refentry.dn))
 681             if str(refentry.dn) == "@PROVISION" and\
 682                 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 683                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 684             delta.dn = refentry.dn
 685             sam.add(delta)
 686         else:
 687             delta = sam.msg_diff(entry[0], refentry)
 688             if str(refentry.dn) == "@ATTRIBUTES":
 689                 deltaattr = sam.msg_diff(refentry, entry[0])
 690             if str(refentry.dn) == "@PROVISION" and\
 691                 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 692                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 693             if len(delta.items()) > 1:
 694                 delta.dn = refentry.dn
 695                 sam.modify(delta)
 696
 697     return deltaattr
 698
 699
 700 def construct_existor_expr(attrs):
 701     """Construct a exists or LDAP search expression.
 702
 703     :param attrs: List of attribute on which we want to create the search
 704         expression.
 705     :return: A string representing the expression, if attrs is empty an
 706         empty string is returned
 707     """
 708     expr = ""
 709     if len(attrs) > 0:
 710         expr = "(|"
 711         for att in attrs:
 712             expr = "%s(%s=*)"%(expr,att)
 713         expr = "%s)"%expr
 714     return expr
 715
 716 def update_machine_account_password(samdb, secrets_ldb, names):
 717     """Update (change) the password of the current DC both in the SAM db and in
 718        secret one
 719
 720     :param samdb: An LDB object related to the sam.ldb file of a given provision
 721     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 722                         provision
 723     :param names: List of key provision parameters"""
 724
 725     expression = "samAccountName=%s$" % names.netbiosname
 726     secrets_msg = secrets_ldb.search(expression=expression,
 727                                         attrs=["secureChannelType"])
 728     if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC:
 729         res = samdb.search(expression=expression, attrs=[])
 730         assert(len(res) == 1)
 731
 732         msg = ldb.Message(res[0].dn)
 733         machinepass = samba.generate_random_password(128, 255)
 734         mputf16 = machinepass.encode('utf-16-le')
 735         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 736                                                 ldb.FLAG_MOD_REPLACE,
 737                                                 "clearTextPassword")
 738         samdb.modify(msg)
 739
 740         res = samdb.search(expression=("samAccountName=%s$" % names.netbiosname),
 741                      attrs=["msDs-keyVersionNumber"])
 742         assert(len(res) == 1)
 743         kvno = int(str(res[0]["msDs-keyVersionNumber"]))
 744         secChanType = int(secrets_msg[0]["secureChannelType"][0])
 745
 746         secretsdb_self_join(secrets_ldb, domain=names.domain,
 747                     realm=names.realm,
 748                     domainsid=names.domainsid,
 749                     dnsdomain=names.dnsdomain,
 750                     netbiosname=names.netbiosname,
 751                     machinepass=machinepass,
 752                     key_version_number=kvno,
 753                     secure_channel_type=secChanType)
 754     else:
 755         raise ProvisioningError("Unable to find a Secure Channel"
 756                                 "of type SEC_CHAN_BDC")
 757
 758 def update_dns_account_password(samdb, secrets_ldb, names):
 759     """Update (change) the password of the dns both in the SAM db and in
 760        secret one
 761
 762     :param samdb: An LDB object related to the sam.ldb file of a given provision
 763     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 764                         provision
 765     :param names: List of key provision parameters"""
 766
 767     expression = "samAccountName=dns-%s" % names.netbiosname
 768     secrets_msg = secrets_ldb.search(expression=expression)
 769     if len(secrets_msg) == 1:
 770         res = samdb.search(expression=expression, attrs=[])
 771         assert(len(res) == 1)
 772
 773         msg = ldb.Message(res[0].dn)
 774         machinepass = samba.generate_random_password(128, 255)
 775         mputf16 = machinepass.encode('utf-16-le')
 776         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 777                                                 ldb.FLAG_MOD_REPLACE,
 778                                                 "clearTextPassword")
 779
 780         samdb.modify(msg)
 781
 782         res = samdb.search(expression=expression,
 783                      attrs=["msDs-keyVersionNumber"])
 784         assert(len(res) == 1)
 785         kvno = str(res[0]["msDs-keyVersionNumber"])
 786
 787         msg = ldb.Message(secrets_msg[0].dn)
 788         msg["secret"] = ldb.MessageElement(machinepass,
 789                                                 ldb.FLAG_MOD_REPLACE,
 790                                                 "secret")
 791         msg["msDS-KeyVersionNumber"] = ldb.MessageElement(kvno,
 792                                                 ldb.FLAG_MOD_REPLACE,
 793                                                 "msDS-KeyVersionNumber")
 794
 795         secrets_ldb.modify(msg)
 796
 797 def search_constructed_attrs_stored(samdb, rootdn, attrs):
 798     """Search a given sam DB for calculated attributes that are
 799     still stored in the db.
 800
 801     :param samdb: An LDB object pointing to the sam
 802     :param rootdn: The base DN where the search should start
 803     :param attrs: A list of attributes to be searched
 804     :return: A hash with attributes as key and an array of
 805              array. Each array contains the dn and the associated
 806              values for this attribute as they are stored in the
 807              sam."""
 808
 809     hashAtt = {}
 810     expr = construct_existor_expr(attrs)
 811     if expr == "":
 812         return hashAtt
 813     entry = samdb.search(expression=expr, base=ldb.Dn(samdb, str(rootdn)),
 814                          scope=SCOPE_SUBTREE, attrs=attrs,
 815                          controls=["search_options:1:2","bypassoperational:0"])
 816     if len(entry) == 0:
 817         # Nothing anymore
 818         return hashAtt
 819
 820     for ent in entry:
 821         for att in attrs:
 822             if ent.get(att):
 823                 if hashAtt.has_key(att):
 824                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 825                 else:
 826                     hashAtt[att] = {}
 827                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 828
 829     return hashAtt
 830
 831 def findprovisionrange(samdb, basedn):
 832     """ Find ranges of usn grouped by invocation id and then by timestamp
 833         rouned at 1 minute
 834
 835         :param samdb: An LDB object pointing to the samdb
 836         :param basedn: The DN of the forest
 837
 838         :return: A two level dictionary with invoication id as the
 839                 first level, timestamp as the second one and then
 840                 max, min, and number as subkeys, representing respectivily
 841                 the maximum usn for the range, the minimum usn and the number
 842                 of object with usn in this range.
 843     """
 844     nb_obj = 0
 845     hash_id = {}
 846
 847     res = samdb.search(base=basedn, expression="objectClass=*",
 848                                     scope=ldb.SCOPE_SUBTREE,
 849                                     attrs=["replPropertyMetaData"],
 850                                     controls=["search_options:1:2"])
 851
 852     for e in res:
 853         nb_obj = nb_obj + 1
 854         obj = ndr_unpack(drsblobs.replPropertyMetaDataBlob,
 855                             str(e["replPropertyMetaData"])).ctr
 856
 857         for o in obj.array:
 858             # like a timestamp but with the resolution of 1 minute
 859             minutestamp =_glue.nttime2unix(o.originating_change_time)/60
 860             hash_ts = hash_id.get(str(o.originating_invocation_id))
 861
 862             if hash_ts is None:
 863                 ob = {}
 864                 ob["min"] = o.originating_usn
 865                 ob["max"] = o.originating_usn
 866                 ob["num"] = 1
 867                 ob["list"] = [str(e.dn)]
 868                 hash_ts = {}
 869             else:
 870                 ob = hash_ts.get(minutestamp)
 871                 if ob is None:
 872                     ob = {}
 873                     ob["min"] = o.originating_usn
 874                     ob["max"] = o.originating_usn
 875                     ob["num"] = 1
 876                     ob["list"] = [str(e.dn)]
 877                 else:
 878                     if ob["min"] > o.originating_usn:
 879                         ob["min"] = o.originating_usn
 880                     if ob["max"] < o.originating_usn:
 881                         ob["max"] = o.originating_usn
 882                     if not (str(e.dn) in ob["list"]):
 883                         ob["num"] = ob["num"] + 1
 884                         ob["list"].append(str(e.dn))
 885             hash_ts[minutestamp] = ob
 886             hash_id[str(o.originating_invocation_id)] = hash_ts
 887
 888     return (hash_id, nb_obj)
 889
 890 def print_provision_ranges(dic, limit_print, dest, samdb_path, invocationid):
 891     """ print the differents ranges passed as parameter
 892
 893         :param dic: A dictionnary as returned by findprovisionrange
 894         :param limit_print: minimum number of object in a range in order to print it
 895         :param dest: Destination directory
 896         :param samdb_path: Path to the sam.ldb file
 897         :param invoicationid: Invocation ID for the current provision
 898     """
 899     ldif = ""
 900
 901     for id in dic:
 902         hash_ts = dic[id]
 903         sorted_keys = []
 904         sorted_keys.extend(hash_ts.keys())
 905         sorted_keys.sort()
 906
 907         kept_record = []
 908         for k in sorted_keys:
 909             obj = hash_ts[k]
 910             if obj["num"] > limit_print:
 911                 dt = _glue.nttime2string(_glue.unix2nttime(k*60))
 912                 print "%s # of modification: %d  \tmin: %d max: %d" % (dt , obj["num"],
 913                                                                     obj["min"],
 914                                                                     obj["max"])
 915             if hash_ts[k]["num"] > 600:
 916                 kept_record.append(k)
 917
 918         # Let's try to concatenate consecutive block if they are in the almost same minutestamp
 919         for i in range(0, len(kept_record)):
 920             if i != 0:
 921                 key1 = kept_record[i]
 922                 key2 = kept_record[i-1]
 923                 if key1 - key2 == 1:
 924                     # previous record is just 1 minute away from current
 925                     if int(hash_ts[key1]["min"]) == int(hash_ts[key2]["max"]) + 1:
 926                         # Copy the highest USN in the previous record
 927                         # and mark the current as skipped
 928                         hash_ts[key2]["max"] = hash_ts[key1]["max"]
 929                         hash_ts[key1]["skipped"] = True
 930
 931         for k in kept_record:
 932                 obj = hash_ts[k]
 933                 if obj.get("skipped") is None:
 934                     ldif = "%slastProvisionUSN: %d-%d;%s\n" % (ldif, obj["min"],
 935                                 obj["max"], id)
 936
 937     if ldif != "":
 938         file = tempfile.mktemp(dir=dest, prefix="usnprov", suffix=".ldif")
 939         print
 940         print "To track the USNs modified/created by provision and upgrade proivsion,"
 941         print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
 942         print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
 943         print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path),file)
 944         ldif = "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid, ldif)
 945         open(file,'w').write(ldif)
 946
 947 def int64range2str(value):
 948     """Display the int64 range stored in value as xxx-yyy
 949
 950     :param value: The int64 range
 951     :return: A string of the representation of the range
 952     """
 953
 954     lvalue = long(value)
 955     str = "%d-%d" % (lvalue&0xFFFFFFFF, lvalue>>32)
 956     return str