source4/scripting/python/samba/upgradehelpers.py

   1 # Helpers for provision stuff
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
   3 #
   4 # Based on provision a Samba4 server by
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 """Helpers used for upgrading between different database formats."""
  23
  24 import os
  25 import re
  26 import shutil
  27 import samba
  28
  29 from samba import Ldb, version, ntacls
  30 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
  31 import ldb
  32 from samba.provision import (provision_paths_from_lp,
  33                             getpolicypath, set_gpos_acl, create_gpo_struct,
  34                             FILL_FULL, provision, ProvisioningError,
  35                             setsysvolacl, secretsdb_self_join)
  36 from samba.dcerpc import xattr, drsblobs
  37 from samba.dcerpc.misc import SEC_CHAN_BDC
  38 from samba.ndr import ndr_unpack
  39 from samba.samdb import SamDB
  40 from samba import _glue
  41 import tempfile
  42
  43 # All the ldb related to registry are commented because the path for them is
  44 # relative in the provisionPath object
  45 # And so opening them create a file in the current directory which is not what
  46 # we want
  47 # I still keep them commented because I plan soon to make more cleaner
  48 ERROR =     -1
  49 SIMPLE =     0x00
  50 CHANGE =     0x01
  51 CHANGESD =     0x02
  52 GUESS =     0x04
  53 PROVISION =    0x08
  54 CHANGEALL =    0xff
  55
  56 hashAttrNotCopied = set(["dn", "whenCreated", "whenChanged", "objectGUID",
  57     "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
  58     "objectCategory", "distinguishedName", "nTMixedDomain",
  59     "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
  60     "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
  61     "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
  62     "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
  63     "possibleInferiors", "privilege", "sAMAccountType"])
  64
  65
  66 class ProvisionLDB(object):
  67
  68     def __init__(self):
  69         self.sam = None
  70         self.secrets = None
  71         self.idmap = None
  72         self.privilege = None
  73         self.hkcr = None
  74         self.hkcu = None
  75         self.hku = None
  76         self.hklm = None
  77
  78     def dbs(self):
  79         return (self.sam, self.secrets, self.idmap, self.privilege)
  80
  81     def startTransactions(self):
  82         for db in self.dbs():
  83             db.transaction_start()
  84 # TO BE DONE
  85 #        self.hkcr.transaction_start()
  86 #        self.hkcu.transaction_start()
  87 #        self.hku.transaction_start()
  88 #        self.hklm.transaction_start()
  89
  90     def groupedRollback(self):
  91         ok = True
  92         for db in self.dbs():
  93             try:
  94                 db.transaction_cancel()
  95             except Exception:
  96                 ok = False
  97         return ok
  98 # TO BE DONE
  99 #        self.hkcr.transaction_cancel()
 100 #        self.hkcu.transaction_cancel()
 101 #        self.hku.transaction_cancel()
 102 #        self.hklm.transaction_cancel()
 103
 104     def groupedCommit(self):
 105         try:
 106             for db in self.dbs():
 107                 db.transaction_prepare_commit()
 108         except Exception:
 109             return self.groupedRollback()
 110 # TO BE DONE
 111 #        self.hkcr.transaction_prepare_commit()
 112 #        self.hkcu.transaction_prepare_commit()
 113 #        self.hku.transaction_prepare_commit()
 114 #        self.hklm.transaction_prepare_commit()
 115         try:
 116             for db in self.dbs():
 117                 db.transaction_commit()
 118         except Exception:
 119             return self.groupedRollback()
 120
 121 # TO BE DONE
 122 #        self.hkcr.transaction_commit()
 123 #        self.hkcu.transaction_commit()
 124 #        self.hku.transaction_commit()
 125 #        self.hklm.transaction_commit()
 126         return True
 127
 128
 129 def get_ldbs(paths, creds, session, lp):
 130     """Return LDB object mapped on most important databases
 131
 132     :param paths: An object holding the different importants paths for provision object
 133     :param creds: Credential used for openning LDB files
 134     :param session: Session to use for openning LDB files
 135     :param lp: A loadparam object
 136     :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
 137
 138     ldbs = ProvisionLDB()
 139
 140     ldbs.sam = SamDB(paths.samdb, session_info=session, credentials=creds, lp=lp, options=["modules:samba_dsdb"])
 141     ldbs.secrets = Ldb(paths.secrets, session_info=session, credentials=creds, lp=lp)
 142     ldbs.idmap = Ldb(paths.idmapdb, session_info=session, credentials=creds, lp=lp)
 143     ldbs.privilege = Ldb(paths.privilege, session_info=session, credentials=creds, lp=lp)
 144 #    ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
 145 #    ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
 146 #    ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
 147 #    ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
 148
 149     return ldbs
 150
 151
 152 def usn_in_range(usn, range):
 153     """Check if the usn is in one of the range provided.
 154     To do so, the value is checked to be between the lower bound and
 155     higher bound of a range
 156
 157     :param usn: A integer value corresponding to the usn that we want to update
 158     :param range: A list of integer representing ranges, lower bounds are in
 159                   the even indices, higher in odd indices
 160     :return: True if the usn is in one of the range, False otherwise
 161     """
 162
 163     idx = 0
 164     cont = True
 165     ok = False
 166     while cont:
 167         if idx ==  len(range):
 168             cont = False
 169             continue
 170         if usn < int(range[idx]):
 171             if idx %2 == 1:
 172                 ok = True
 173             cont = False
 174         if usn == int(range[idx]):
 175             cont = False
 176             ok = True
 177         idx = idx + 1
 178     return ok
 179
 180
 181 def get_paths(param, targetdir=None, smbconf=None):
 182     """Get paths to important provision objects (smb.conf, ldb files, ...)
 183
 184     :param param: Param object
 185     :param targetdir: Directory where the provision is (or will be) stored
 186     :param smbconf: Path to the smb.conf file
 187     :return: A list with the path of important provision objects"""
 188     if targetdir is not None:
 189         if not os.path.exists(targetdir):
 190             os.mkdir(targetdir)
 191         etcdir = os.path.join(targetdir, "etc")
 192         if not os.path.exists(etcdir):
 193             os.makedirs(etcdir)
 194         smbconf = os.path.join(etcdir, "smb.conf")
 195     if smbconf is None:
 196         smbconf = param.default_path()
 197
 198     if not os.path.exists(smbconf):
 199         raise ProvisioningError("Unable to find smb.conf")
 200
 201     lp = param.LoadParm()
 202     lp.load(smbconf)
 203     paths = provision_paths_from_lp(lp, lp.get("realm"))
 204     return paths
 205
 206 def update_policyids(names, samdb):
 207     """Update policy ids that could have changed after sam update
 208
 209     :param names: List of key provision parameters
 210     :param samdb: An Ldb object conntected with the sam DB
 211     """
 212     # policy guid
 213     res = samdb.search(expression="(displayName=Default Domain Policy)",
 214                         base="CN=Policies,CN=System," + str(names.rootdn),
 215                         scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
 216     names.policyid = str(res[0]["cn"]).replace("{","").replace("}","")
 217     # dc policy guid
 218     res2 = samdb.search(expression="(displayName=Default Domain Controllers"
 219                                    " Policy)",
 220                             base="CN=Policies,CN=System," + str(names.rootdn),
 221                             scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
 222     if len(res2) == 1:
 223         names.policyid_dc = str(res2[0]["cn"]).replace("{","").replace("}","")
 224     else:
 225         names.policyid_dc = None
 226
 227
 228 def newprovision(names, creds, session, smbconf, provdir, logger):
 229     """Create a new provision.
 230
 231     This provision will be the reference for knowing what has changed in the
 232     since the latest upgrade in the current provision
 233
 234     :param names: List of provision parameters
 235     :param creds: Credentials for the authentification
 236     :param session: Session object
 237     :param smbconf: Path to the smb.conf file
 238     :param provdir: Directory where the provision will be stored
 239     :param logger: A Logger
 240     """
 241     if os.path.isdir(provdir):
 242         shutil.rmtree(provdir)
 243     os.mkdir(provdir)
 244     logger.info("Provision stored in %s", provdir)
 245     return provision(logger, session, creds, smbconf=smbconf,
 246             targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm,
 247             domain=names.domain, domainguid=names.domainguid,
 248             domainsid=str(names.domainsid), ntdsguid=names.ntdsguid,
 249             policyguid=names.policyid, policyguid_dc=names.policyid_dc,
 250             hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
 251             invocationid=names.invocation, adminpass=names.adminpass,
 252             krbtgtpass=None, machinepass=None, dnspass=None, root=None,
 253             nobody=None, users=None,
 254             serverrole="domain controller",
 255             backend_type=None, ldapadminpass=None, ol_mmr_urls=None,
 256             slapd_path=None,
 257             dom_for_fun_level=names.domainlevel, dns_backend=names.dns_backend,
 258             useeadb=True, use_ntvfs=True)
 259
 260
 261 def dn_sort(x, y):
 262     """Sorts two DNs in the lexicographical order it and put higher level DN
 263     before.
 264
 265     So given the dns cn=bar,cn=foo and cn=foo the later will be return as
 266     smaller
 267
 268     :param x: First object to compare
 269     :param y: Second object to compare
 270     """
 271     p = re.compile(r'(?<!\\), ?')
 272     tab1 = p.split(str(x))
 273     tab2 = p.split(str(y))
 274     minimum = min(len(tab1), len(tab2))
 275     len1 = len(tab1)-1
 276     len2 = len(tab2)-1
 277     # Note: python range go up to upper limit but do not include it
 278     for i in range(0, minimum):
 279         ret = cmp(tab1[len1-i], tab2[len2-i])
 280         if ret != 0:
 281             return ret
 282         else:
 283             if i == minimum-1:
 284                 assert len1!=len2,"PB PB PB" + " ".join(tab1)+" / " + " ".join(tab2)
 285                 if len1 > len2:
 286                     return 1
 287                 else:
 288                     return -1
 289     return ret
 290
 291
 292 def identic_rename(ldbobj, dn):
 293     """Perform a back and forth rename to trigger renaming on attribute that
 294     can't be directly modified.
 295
 296     :param lbdobj: An Ldb Object
 297     :param dn: DN of the object to manipulate
 298     """
 299     (before, after) = str(dn).split('=', 1)
 300     # we need to use relax to avoid the subtree_rename constraints
 301     ldbobj.rename(dn, ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), ["relax:0"])
 302     ldbobj.rename(ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), dn, ["relax:0"])
 303
 304
 305 def chunck_acl(acl):
 306     """Return separate ACE of an ACL
 307
 308     :param acl: A string representing the ACL
 309     :return: A hash with different parts
 310     """
 311
 312     p = re.compile(r'(\w+)?(\(.*?\))')
 313     tab = p.findall(acl)
 314
 315     hash = {}
 316     hash["aces"] = []
 317     for e in tab:
 318         if len(e[0]) > 0:
 319             hash["flags"] = e[0]
 320         hash["aces"].append(e[1])
 321
 322     return hash
 323
 324
 325 def chunck_sddl(sddl):
 326     """ Return separate parts of the SDDL (owner, group, ...)
 327
 328     :param sddl: An string containing the SDDL to chunk
 329     :return: A hash with the different chunk
 330     """
 331
 332     p = re.compile(r'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
 333     tab = p.findall(sddl)
 334
 335     hash = {}
 336     for e in tab:
 337         if e[0] == "O:":
 338             hash["owner"] = e[1]
 339         if e[0] == "G:":
 340             hash["group"] = e[1]
 341         if e[0] == "D:":
 342             hash["dacl"] = e[1]
 343         if e[0] == "S:":
 344             hash["sacl"] = e[1]
 345
 346     return hash
 347
 348
 349 def get_diff_sddls(refsddl, cursddl, checkSacl = True):
 350     """Get the difference between 2 sddl
 351
 352     This function split the textual representation of ACL into smaller
 353     chunck in order to not to report a simple permutation as a difference
 354
 355     :param refsddl: First sddl to compare
 356     :param cursddl: Second sddl to compare
 357     :param checkSacl: If false we skip the sacl checks
 358     :return: A string that explain difference between sddls
 359     """
 360
 361     txt = ""
 362     hash_cur = chunck_sddl(cursddl)
 363     hash_ref = chunck_sddl(refsddl)
 364
 365     if not hash_cur.has_key("owner"):
 366         txt = "\tNo owner in current SD"
 367     elif hash_cur["owner"] != hash_ref["owner"]:
 368         txt = "\tOwner mismatch: %s (in ref) %s" \
 369               "(in current)\n" % (hash_ref["owner"], hash_cur["owner"])
 370
 371     if not hash_cur.has_key("group"):
 372         txt = "%s\tNo group in current SD" % txt
 373     elif hash_cur["group"] != hash_ref["group"]:
 374         txt = "%s\tGroup mismatch: %s (in ref) %s" \
 375               "(in current)\n" % (txt, hash_ref["group"], hash_cur["group"])
 376
 377     parts = [ "dacl" ]
 378     if checkSacl:
 379         parts.append("sacl")
 380     for part in parts:
 381         if hash_cur.has_key(part) and hash_ref.has_key(part):
 382
 383             # both are present, check if they contain the same ACE
 384             h_cur = set()
 385             h_ref = set()
 386             c_cur = chunck_acl(hash_cur[part])
 387             c_ref = chunck_acl(hash_ref[part])
 388
 389             for elem in c_cur["aces"]:
 390                 h_cur.add(elem)
 391
 392             for elem in c_ref["aces"]:
 393                 h_ref.add(elem)
 394
 395             for k in set(h_ref):
 396                 if k in h_cur:
 397                     h_cur.remove(k)
 398                     h_ref.remove(k)
 399
 400             if len(h_cur) + len(h_ref) > 0:
 401                 txt = "%s\tPart %s is different between reference" \
 402                       " and current here is the detail:\n" % (txt, part)
 403
 404                 for item in h_cur:
 405                     txt = "%s\t\t%s ACE is not present in the" \
 406                           " reference\n" % (txt, item)
 407
 408                 for item in h_ref:
 409                     txt = "%s\t\t%s ACE is not present in the" \
 410                           " current\n" % (txt, item)
 411
 412         elif hash_cur.has_key(part) and not hash_ref.has_key(part):
 413             txt = "%s\tReference ACL hasn't a %s part\n" % (txt, part)
 414         elif not hash_cur.has_key(part) and hash_ref.has_key(part):
 415             txt = "%s\tCurrent ACL hasn't a %s part\n" % (txt, part)
 416
 417     return txt
 418
 419
 420 def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
 421     """Update secrets.ldb
 422
 423     :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
 424         of the reference provision
 425     :param secrets_ldb: An LDB object that is connected to the secrets.ldb
 426         of the updated provision
 427     """
 428
 429     messagefunc(SIMPLE, "Update of secrets.ldb")
 430     reference = newsecrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 431     current = secrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
 432     assert reference, "Reference modules list can not be empty"
 433     if len(current) == 0:
 434         # No modules present
 435         delta = secrets_ldb.msg_diff(ldb.Message(), reference[0])
 436         delta.dn = reference[0].dn
 437         secrets_ldb.add(reference[0])
 438     else:
 439         delta = secrets_ldb.msg_diff(current[0], reference[0])
 440         delta.dn = current[0].dn
 441         secrets_ldb.modify(delta)
 442
 443     reference = newsecrets_ldb.search(expression="objectClass=top", base="",
 444                                         scope=SCOPE_SUBTREE, attrs=["dn"])
 445     current = secrets_ldb.search(expression="objectClass=top", base="",
 446                                         scope=SCOPE_SUBTREE, attrs=["dn"])
 447     hash_new = {}
 448     hash = {}
 449     listMissing = []
 450     listPresent = []
 451
 452     empty = ldb.Message()
 453     for i in range(0, len(reference)):
 454         hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"]
 455
 456     # Create a hash for speeding the search of existing object in the
 457     # current provision
 458     for i in range(0, len(current)):
 459         hash[str(current[i]["dn"]).lower()] = current[i]["dn"]
 460
 461     for k in hash_new.keys():
 462         if not hash.has_key(k):
 463             listMissing.append(hash_new[k])
 464         else:
 465             listPresent.append(hash_new[k])
 466
 467     for entry in listMissing:
 468         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 469                                             base="", scope=SCOPE_SUBTREE)
 470         current = secrets_ldb.search(expression="distinguishedName=%s" % entry,
 471                                             base="", scope=SCOPE_SUBTREE)
 472         delta = secrets_ldb.msg_diff(empty, reference[0])
 473         for att in hashAttrNotCopied:
 474             delta.remove(att)
 475         messagefunc(CHANGE, "Entry %s is missing from secrets.ldb" %
 476                     reference[0].dn)
 477         for att in delta:
 478             messagefunc(CHANGE, " Adding attribute %s" % att)
 479         delta.dn = reference[0].dn
 480         secrets_ldb.add(delta)
 481
 482     for entry in listPresent:
 483         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
 484                                             base="", scope=SCOPE_SUBTREE)
 485         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 486                                             scope=SCOPE_SUBTREE)
 487         delta = secrets_ldb.msg_diff(current[0], reference[0])
 488         for att in hashAttrNotCopied:
 489             delta.remove(att)
 490         for att in delta:
 491             if att == "name":
 492                 messagefunc(CHANGE, "Found attribute name on  %s,"
 493                                     " must rename the DN" % (current[0].dn))
 494                 identic_rename(secrets_ldb, reference[0].dn)
 495             else:
 496                 delta.remove(att)
 497
 498     for entry in listPresent:
 499         reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 500                                             scope=SCOPE_SUBTREE)
 501         current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
 502                                             scope=SCOPE_SUBTREE)
 503         delta = secrets_ldb.msg_diff(current[0], reference[0])
 504         for att in hashAttrNotCopied:
 505             delta.remove(att)
 506         for att in delta:
 507             if att == "msDS-KeyVersionNumber":
 508                 delta.remove(att)
 509             if att != "dn":
 510                 messagefunc(CHANGE,
 511                             "Adding/Changing attribute %s to %s" %
 512                             (att, current[0].dn))
 513
 514         delta.dn = current[0].dn
 515         secrets_ldb.modify(delta)
 516
 517     res2 = secrets_ldb.search(expression="(samaccountname=dns)",
 518                                 scope=SCOPE_SUBTREE, attrs=["dn"])
 519
 520     if len(res2) == 1:
 521             messagefunc(SIMPLE, "Remove old dns account")
 522             secrets_ldb.delete(res2[0]["dn"])
 523
 524
 525 def getOEMInfo(samdb, rootdn):
 526     """Return OEM Information on the top level Samba4 use to store version
 527     info in this field
 528
 529     :param samdb: An LDB object connect to sam.ldb
 530     :param rootdn: Root DN of the domain
 531     :return: The content of the field oEMInformation (if any)
 532     """
 533     res = samdb.search(expression="(objectClass=*)", base=str(rootdn),
 534                             scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 535     if len(res) > 0 and res[0].get("oEMInformation"):
 536         info = res[0]["oEMInformation"]
 537         return info
 538     else:
 539         return ""
 540
 541
 542 def updateOEMInfo(samdb, rootdn):
 543     """Update the OEMinfo field to add information about upgrade
 544
 545     :param samdb: an LDB object connected to the sam DB
 546     :param rootdn: The string representation of the root DN of
 547         the provision (ie. DC=...,DC=...)
 548     """
 549     res = samdb.search(expression="(objectClass=*)", base=rootdn,
 550                             scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
 551     if len(res) > 0:
 552         if res[0].get("oEMInformation"):
 553             info = str(res[0]["oEMInformation"])
 554         else:
 555             info = ""
 556         info = "%s, upgrade to %s" % (info, version)
 557         delta = ldb.Message()
 558         delta.dn = ldb.Dn(samdb, str(res[0]["dn"]))
 559         delta["oEMInformation"] = ldb.MessageElement(info, ldb.FLAG_MOD_REPLACE,
 560                                                         "oEMInformation" )
 561         samdb.modify(delta)
 562
 563 def update_gpo(paths, samdb, names, lp, message, force=0):
 564     """Create missing GPO file object if needed
 565
 566     Set ACL correctly also.
 567     Check ACLs for sysvol/netlogon dirs also
 568     """
 569     resetacls = False
 570     try:
 571         ntacls.checkset_backend(lp, None, None)
 572         eadbname = lp.get("posix:eadb")
 573         if eadbname is not None and eadbname != "":
 574             try:
 575                 attribute = samba.xattr_tdb.wrap_getxattr(eadbname,
 576                                 paths.sysvol, xattr.XATTR_NTACL_NAME)
 577             except Exception:
 578                 attribute = samba.xattr_native.wrap_getxattr(paths.sysvol,
 579                                 xattr.XATTR_NTACL_NAME)
 580         else:
 581             attribute = samba.xattr_native.wrap_getxattr(paths.sysvol,
 582                                 xattr.XATTR_NTACL_NAME)
 583     except Exception:
 584        resetacls = True
 585
 586     if force:
 587         resetacls = True
 588
 589     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid)
 590     if not os.path.isdir(dir):
 591         create_gpo_struct(dir)
 592
 593     if names.policyid_dc is None:
 594         raise ProvisioningError("Policy ID for Domain controller is missing")
 595     dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
 596     if not os.path.isdir(dir):
 597         create_gpo_struct(dir)
 598
 599     def acl_error(e):
 600         if os.geteuid() == 0:
 601             message(ERROR, "Unable to set ACLs on policies related objects: %s" % e)
 602         else:
 603             message(ERROR, "Unable to set ACLs on policies related objects. "
 604                     "ACLs must be set as root if file system ACLs "
 605                     "(rather than posix:eadb) are used.")
 606
 607     # We always reinforce acls on GPO folder because they have to be in sync
 608     # with the one in DS
 609     try:
 610         set_gpos_acl(paths.sysvol, names.dnsdomain, names.domainsid,
 611             names.domaindn, samdb, lp)
 612     except TypeError, e:
 613         acl_error(e)
 614
 615     if resetacls:
 616        try:
 617             setsysvolacl(samdb, paths.netlogon, paths.sysvol, names.root_gid,
 618                         names.domainsid, names.dnsdomain, names.domaindn, lp)
 619        except TypeError, e:
 620            acl_error(e)
 621
 622
 623 def increment_calculated_keyversion_number(samdb, rootdn, hashDns):
 624     """For a given hash associating dn and a number, this function will
 625     update the replPropertyMetaData of each dn in the hash, so that the
 626     calculated value of the msDs-KeyVersionNumber is equal or superior to the
 627     one associated to the given dn.
 628
 629     :param samdb: An SamDB object pointing to the sam
 630     :param rootdn: The base DN where we want to start
 631     :param hashDns: A hash with dn as key and number representing the
 632                  minimum value of msDs-KeyVersionNumber that we want to
 633                  have
 634     """
 635     entry = samdb.search(expression='(objectClass=user)',
 636                          base=ldb.Dn(samdb,str(rootdn)),
 637                          scope=SCOPE_SUBTREE, attrs=["msDs-KeyVersionNumber"],
 638                          controls=["search_options:1:2"])
 639     done = 0
 640     hashDone = {}
 641     if len(entry) == 0:
 642         raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
 643     else:
 644         for e in entry:
 645             if hashDns.has_key(str(e.dn).lower()):
 646                 val = e.get("msDs-KeyVersionNumber")
 647                 if not val:
 648                     val = "0"
 649                 version = int(str(hashDns[str(e.dn).lower()]))
 650                 if int(str(val)) < version:
 651                     done = done + 1
 652                     samdb.set_attribute_replmetadata_version(str(e.dn),
 653                                                               "unicodePwd",
 654                                                               version, True)
 655 def delta_update_basesamdb(refsampath, sampath, creds, session, lp, message):
 656     """Update the provision container db: sam.ldb
 657     This function is aimed for alpha9 and newer;
 658
 659     :param refsampath: Path to the samdb in the reference provision
 660     :param sampath: Path to the samdb in the upgraded provision
 661     :param creds: Credential used for openning LDB files
 662     :param session: Session to use for openning LDB files
 663     :param lp: A loadparam object
 664     :return: A msg_diff object with the difference between the @ATTRIBUTES
 665              of the current provision and the reference provision
 666     """
 667
 668     message(SIMPLE,
 669             "Update base samdb by searching difference with reference one")
 670     refsam = Ldb(refsampath, session_info=session, credentials=creds,
 671                     lp=lp, options=["modules:"])
 672     sam = Ldb(sampath, session_info=session, credentials=creds, lp=lp,
 673                 options=["modules:"])
 674
 675     empty = ldb.Message()
 676     deltaattr = None
 677     reference = refsam.search(expression="")
 678
 679     for refentry in reference:
 680         entry = sam.search(expression="distinguishedName=%s" % refentry["dn"],
 681                             scope=SCOPE_SUBTREE)
 682         if not len(entry):
 683             delta = sam.msg_diff(empty, refentry)
 684             message(CHANGE, "Adding %s to sam db" % str(refentry.dn))
 685             if str(refentry.dn) == "@PROVISION" and\
 686                 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 687                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 688             delta.dn = refentry.dn
 689             sam.add(delta)
 690         else:
 691             delta = sam.msg_diff(entry[0], refentry)
 692             if str(refentry.dn) == "@ATTRIBUTES":
 693                 deltaattr = sam.msg_diff(refentry, entry[0])
 694             if str(refentry.dn) == "@PROVISION" and\
 695                 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
 696                 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
 697             if len(delta.items()) > 1:
 698                 delta.dn = refentry.dn
 699                 sam.modify(delta)
 700
 701     return deltaattr
 702
 703
 704 def construct_existor_expr(attrs):
 705     """Construct a exists or LDAP search expression.
 706
 707     :param attrs: List of attribute on which we want to create the search
 708         expression.
 709     :return: A string representing the expression, if attrs is empty an
 710         empty string is returned
 711     """
 712     expr = ""
 713     if len(attrs) > 0:
 714         expr = "(|"
 715         for att in attrs:
 716             expr = "%s(%s=*)"%(expr,att)
 717         expr = "%s)"%expr
 718     return expr
 719
 720 def update_machine_account_password(samdb, secrets_ldb, names):
 721     """Update (change) the password of the current DC both in the SAM db and in
 722        secret one
 723
 724     :param samdb: An LDB object related to the sam.ldb file of a given provision
 725     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 726                         provision
 727     :param names: List of key provision parameters"""
 728
 729     expression = "samAccountName=%s$" % names.netbiosname
 730     secrets_msg = secrets_ldb.search(expression=expression,
 731                                         attrs=["secureChannelType"])
 732     if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC:
 733         res = samdb.search(expression=expression, attrs=[])
 734         assert(len(res) == 1)
 735
 736         msg = ldb.Message(res[0].dn)
 737         machinepass = samba.generate_random_password(128, 255)
 738         mputf16 = machinepass.encode('utf-16-le')
 739         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 740                                                 ldb.FLAG_MOD_REPLACE,
 741                                                 "clearTextPassword")
 742         samdb.modify(msg)
 743
 744         res = samdb.search(expression=("samAccountName=%s$" % names.netbiosname),
 745                      attrs=["msDs-keyVersionNumber"])
 746         assert(len(res) == 1)
 747         kvno = int(str(res[0]["msDs-keyVersionNumber"]))
 748         secChanType = int(secrets_msg[0]["secureChannelType"][0])
 749
 750         secretsdb_self_join(secrets_ldb, domain=names.domain,
 751                     realm=names.realm,
 752                     domainsid=names.domainsid,
 753                     dnsdomain=names.dnsdomain,
 754                     netbiosname=names.netbiosname,
 755                     machinepass=machinepass,
 756                     key_version_number=kvno,
 757                     secure_channel_type=secChanType)
 758     else:
 759         raise ProvisioningError("Unable to find a Secure Channel"
 760                                 "of type SEC_CHAN_BDC")
 761
 762 def update_dns_account_password(samdb, secrets_ldb, names):
 763     """Update (change) the password of the dns both in the SAM db and in
 764        secret one
 765
 766     :param samdb: An LDB object related to the sam.ldb file of a given provision
 767     :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
 768                         provision
 769     :param names: List of key provision parameters"""
 770
 771     expression = "samAccountName=dns-%s" % names.netbiosname
 772     secrets_msg = secrets_ldb.search(expression=expression)
 773     if len(secrets_msg) == 1:
 774         res = samdb.search(expression=expression, attrs=[])
 775         assert(len(res) == 1)
 776
 777         msg = ldb.Message(res[0].dn)
 778         machinepass = samba.generate_random_password(128, 255)
 779         mputf16 = machinepass.encode('utf-16-le')
 780         msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 781                                                 ldb.FLAG_MOD_REPLACE,
 782                                                 "clearTextPassword")
 783
 784         samdb.modify(msg)
 785
 786         res = samdb.search(expression=expression,
 787                      attrs=["msDs-keyVersionNumber"])
 788         assert(len(res) == 1)
 789         kvno = str(res[0]["msDs-keyVersionNumber"])
 790
 791         msg = ldb.Message(secrets_msg[0].dn)
 792         msg["secret"] = ldb.MessageElement(machinepass,
 793                                                 ldb.FLAG_MOD_REPLACE,
 794                                                 "secret")
 795         msg["msDS-KeyVersionNumber"] = ldb.MessageElement(kvno,
 796                                                 ldb.FLAG_MOD_REPLACE,
 797                                                 "msDS-KeyVersionNumber")
 798
 799         secrets_ldb.modify(msg)
 800
 801 def search_constructed_attrs_stored(samdb, rootdn, attrs):
 802     """Search a given sam DB for calculated attributes that are
 803     still stored in the db.
 804
 805     :param samdb: An LDB object pointing to the sam
 806     :param rootdn: The base DN where the search should start
 807     :param attrs: A list of attributes to be searched
 808     :return: A hash with attributes as key and an array of
 809              array. Each array contains the dn and the associated
 810              values for this attribute as they are stored in the
 811              sam."""
 812
 813     hashAtt = {}
 814     expr = construct_existor_expr(attrs)
 815     if expr == "":
 816         return hashAtt
 817     entry = samdb.search(expression=expr, base=ldb.Dn(samdb, str(rootdn)),
 818                          scope=SCOPE_SUBTREE, attrs=attrs,
 819                          controls=["search_options:1:2","bypassoperational:0"])
 820     if len(entry) == 0:
 821         # Nothing anymore
 822         return hashAtt
 823
 824     for ent in entry:
 825         for att in attrs:
 826             if ent.get(att):
 827                 if hashAtt.has_key(att):
 828                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 829                 else:
 830                     hashAtt[att] = {}
 831                     hashAtt[att][str(ent.dn).lower()] = str(ent[att])
 832
 833     return hashAtt
 834
 835 def findprovisionrange(samdb, basedn):
 836     """ Find ranges of usn grouped by invocation id and then by timestamp
 837         rouned at 1 minute
 838
 839         :param samdb: An LDB object pointing to the samdb
 840         :param basedn: The DN of the forest
 841
 842         :return: A two level dictionary with invoication id as the
 843                 first level, timestamp as the second one and then
 844                 max, min, and number as subkeys, representing respectivily
 845                 the maximum usn for the range, the minimum usn and the number
 846                 of object with usn in this range.
 847     """
 848     nb_obj = 0
 849     hash_id = {}
 850
 851     res = samdb.search(base=basedn, expression="objectClass=*",
 852                                     scope=ldb.SCOPE_SUBTREE,
 853                                     attrs=["replPropertyMetaData"],
 854                                     controls=["search_options:1:2"])
 855
 856     for e in res:
 857         nb_obj = nb_obj + 1
 858         obj = ndr_unpack(drsblobs.replPropertyMetaDataBlob,
 859                             str(e["replPropertyMetaData"])).ctr
 860
 861         for o in obj.array:
 862             # like a timestamp but with the resolution of 1 minute
 863             minutestamp =_glue.nttime2unix(o.originating_change_time)/60
 864             hash_ts = hash_id.get(str(o.originating_invocation_id))
 865
 866             if hash_ts is None:
 867                 ob = {}
 868                 ob["min"] = o.originating_usn
 869                 ob["max"] = o.originating_usn
 870                 ob["num"] = 1
 871                 ob["list"] = [str(e.dn)]
 872                 hash_ts = {}
 873             else:
 874                 ob = hash_ts.get(minutestamp)
 875                 if ob is None:
 876                     ob = {}
 877                     ob["min"] = o.originating_usn
 878                     ob["max"] = o.originating_usn
 879                     ob["num"] = 1
 880                     ob["list"] = [str(e.dn)]
 881                 else:
 882                     if ob["min"] > o.originating_usn:
 883                         ob["min"] = o.originating_usn
 884                     if ob["max"] < o.originating_usn:
 885                         ob["max"] = o.originating_usn
 886                     if not (str(e.dn) in ob["list"]):
 887                         ob["num"] = ob["num"] + 1
 888                         ob["list"].append(str(e.dn))
 889             hash_ts[minutestamp] = ob
 890             hash_id[str(o.originating_invocation_id)] = hash_ts
 891
 892     return (hash_id, nb_obj)
 893
 894 def print_provision_ranges(dic, limit_print, dest, samdb_path, invocationid):
 895     """ print the differents ranges passed as parameter
 896
 897         :param dic: A dictionnary as returned by findprovisionrange
 898         :param limit_print: minimum number of object in a range in order to print it
 899         :param dest: Destination directory
 900         :param samdb_path: Path to the sam.ldb file
 901         :param invoicationid: Invocation ID for the current provision
 902     """
 903     ldif = ""
 904
 905     for id in dic:
 906         hash_ts = dic[id]
 907         sorted_keys = []
 908         sorted_keys.extend(hash_ts.keys())
 909         sorted_keys.sort()
 910
 911         kept_record = []
 912         for k in sorted_keys:
 913             obj = hash_ts[k]
 914             if obj["num"] > limit_print:
 915                 dt = _glue.nttime2string(_glue.unix2nttime(k*60))
 916                 print "%s # of modification: %d  \tmin: %d max: %d" % (dt , obj["num"],
 917                                                                     obj["min"],
 918                                                                     obj["max"])
 919             if hash_ts[k]["num"] > 600:
 920                 kept_record.append(k)
 921
 922         # Let's try to concatenate consecutive block if they are in the almost same minutestamp
 923         for i in range(0, len(kept_record)):
 924             if i != 0:
 925                 key1 = kept_record[i]
 926                 key2 = kept_record[i-1]
 927                 if key1 - key2 == 1:
 928                     # previous record is just 1 minute away from current
 929                     if int(hash_ts[key1]["min"]) == int(hash_ts[key2]["max"]) + 1:
 930                         # Copy the highest USN in the previous record
 931                         # and mark the current as skipped
 932                         hash_ts[key2]["max"] = hash_ts[key1]["max"]
 933                         hash_ts[key1]["skipped"] = True
 934
 935         for k in kept_record:
 936                 obj = hash_ts[k]
 937                 if obj.get("skipped") is None:
 938                     ldif = "%slastProvisionUSN: %d-%d;%s\n" % (ldif, obj["min"],
 939                                 obj["max"], id)
 940
 941     if ldif != "":
 942         file = tempfile.mktemp(dir=dest, prefix="usnprov", suffix=".ldif")
 943         print
 944         print "To track the USNs modified/created by provision and upgrade proivsion,"
 945         print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
 946         print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
 947         print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path),file)
 948         ldif = "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid, ldif)
 949         open(file,'w').write(ldif)
 950
 951 def int64range2str(value):
 952     """Display the int64 range stored in value as xxx-yyy
 953
 954     :param value: The int64 range
 955     :return: A string of the representation of the range
 956     """
 957
 958     lvalue = long(value)
 959     str = "%d-%d" % (lvalue&0xFFFFFFFF, lvalue>>32)
 960     return str