1 # Helpers for provision stuff
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
4 # Based on provision a Samba4 server by
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 """Helpers used for upgrading between different database formats."""
29 from samba
import Ldb
, version
, ntacls
30 from ldb
import SCOPE_SUBTREE
, SCOPE_ONELEVEL
, SCOPE_BASE
32 from samba
.provision
import (provision_paths_from_lp
,
33 getpolicypath
, set_gpos_acl
, create_gpo_struct
,
34 FILL_FULL
, provision
, ProvisioningError
,
35 setsysvolacl
, secretsdb_self_join
)
36 from samba
.dcerpc
import xattr
, drsblobs
, security
37 from samba
.dcerpc
.misc
import SEC_CHAN_BDC
38 from samba
.ndr
import ndr_unpack
39 from samba
.samdb
import SamDB
40 from samba
import _glue
43 # All the ldb related to registry are commented because the path for them is
44 # relative in the provisionPath object
45 # And so opening them create a file in the current directory which is not what
47 # I still keep them commented because I plan soon to make more cleaner
56 hashAttrNotCopied
= set(["dn", "whenCreated", "whenChanged", "objectGUID",
57 "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
58 "objectCategory", "distinguishedName", "nTMixedDomain",
59 "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
60 "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
61 "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
62 "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
63 "possibleInferiors", "privilege", "sAMAccountType"])
66 class ProvisionLDB(object):
79 return (self
.sam
, self
.secrets
, self
.idmap
, self
.privilege
)
81 def startTransactions(self
):
83 db
.transaction_start()
85 # self.hkcr.transaction_start()
86 # self.hkcu.transaction_start()
87 # self.hku.transaction_start()
88 # self.hklm.transaction_start()
90 def groupedRollback(self
):
94 db
.transaction_cancel()
99 # self.hkcr.transaction_cancel()
100 # self.hkcu.transaction_cancel()
101 # self.hku.transaction_cancel()
102 # self.hklm.transaction_cancel()
104 def groupedCommit(self
):
106 for db
in self
.dbs():
107 db
.transaction_prepare_commit()
109 return self
.groupedRollback()
111 # self.hkcr.transaction_prepare_commit()
112 # self.hkcu.transaction_prepare_commit()
113 # self.hku.transaction_prepare_commit()
114 # self.hklm.transaction_prepare_commit()
116 for db
in self
.dbs():
117 db
.transaction_commit()
119 return self
.groupedRollback()
122 # self.hkcr.transaction_commit()
123 # self.hkcu.transaction_commit()
124 # self.hku.transaction_commit()
125 # self.hklm.transaction_commit()
129 def get_ldbs(paths
, creds
, session
, lp
):
130 """Return LDB object mapped on most important databases
132 :param paths: An object holding the different importants paths for provision object
133 :param creds: Credential used for openning LDB files
134 :param session: Session to use for openning LDB files
135 :param lp: A loadparam object
136 :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
138 ldbs
= ProvisionLDB()
140 ldbs
.sam
= SamDB(paths
.samdb
, session_info
=session
, credentials
=creds
, lp
=lp
, options
=["modules:samba_dsdb"])
141 ldbs
.secrets
= Ldb(paths
.secrets
, session_info
=session
, credentials
=creds
, lp
=lp
)
142 ldbs
.idmap
= Ldb(paths
.idmapdb
, session_info
=session
, credentials
=creds
, lp
=lp
)
143 ldbs
.privilege
= Ldb(paths
.privilege
, session_info
=session
, credentials
=creds
, lp
=lp
)
144 # ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
145 # ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
146 # ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
147 # ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
152 def usn_in_range(usn
, range):
153 """Check if the usn is in one of the range provided.
154 To do so, the value is checked to be between the lower bound and
155 higher bound of a range
157 :param usn: A integer value corresponding to the usn that we want to update
158 :param range: A list of integer representing ranges, lower bounds are in
159 the even indices, higher in odd indices
160 :return: True if the usn is in one of the range, False otherwise
167 if idx
== len(range):
170 if usn
< int(range[idx
]):
174 if usn
== int(range[idx
]):
181 def get_paths(param
, targetdir
=None, smbconf
=None):
182 """Get paths to important provision objects (smb.conf, ldb files, ...)
184 :param param: Param object
185 :param targetdir: Directory where the provision is (or will be) stored
186 :param smbconf: Path to the smb.conf file
187 :return: A list with the path of important provision objects"""
188 if targetdir
is not None:
189 if not os
.path
.exists(targetdir
):
191 etcdir
= os
.path
.join(targetdir
, "etc")
192 if not os
.path
.exists(etcdir
):
194 smbconf
= os
.path
.join(etcdir
, "smb.conf")
196 smbconf
= param
.default_path()
198 if not os
.path
.exists(smbconf
):
199 raise ProvisioningError("Unable to find smb.conf")
201 lp
= param
.LoadParm()
203 paths
= provision_paths_from_lp(lp
, lp
.get("realm"))
206 def update_policyids(names
, samdb
):
207 """Update policy ids that could have changed after sam update
209 :param names: List of key provision parameters
210 :param samdb: An Ldb object conntected with the sam DB
213 res
= samdb
.search(expression
="(displayName=Default Domain Policy)",
214 base
="CN=Policies,CN=System," + str(names
.rootdn
),
215 scope
=SCOPE_ONELEVEL
, attrs
=["cn","displayName"])
216 names
.policyid
= str(res
[0]["cn"]).replace("{","").replace("}","")
218 res2
= samdb
.search(expression
="(displayName=Default Domain Controllers"
220 base
="CN=Policies,CN=System," + str(names
.rootdn
),
221 scope
=SCOPE_ONELEVEL
, attrs
=["cn","displayName"])
223 names
.policyid_dc
= str(res2
[0]["cn"]).replace("{","").replace("}","")
225 names
.policyid_dc
= None
228 def newprovision(names
, creds
, session
, smbconf
, provdir
, logger
):
229 """Create a new provision.
231 This provision will be the reference for knowing what has changed in the
232 since the latest upgrade in the current provision
234 :param names: List of provision parameters
235 :param creds: Credentials for the authentification
236 :param session: Session object
237 :param smbconf: Path to the smb.conf file
238 :param provdir: Directory where the provision will be stored
239 :param logger: A Logger
241 if os
.path
.isdir(provdir
):
242 shutil
.rmtree(provdir
)
244 logger
.info("Provision stored in %s", provdir
)
245 return provision(logger
, session
, creds
, smbconf
=smbconf
,
246 targetdir
=provdir
, samdb_fill
=FILL_FULL
, realm
=names
.realm
,
247 domain
=names
.domain
, domainguid
=names
.domainguid
,
248 domainsid
=str(names
.domainsid
), ntdsguid
=names
.ntdsguid
,
249 policyguid
=names
.policyid
, policyguid_dc
=names
.policyid_dc
,
250 hostname
=names
.netbiosname
.lower(), hostip
=None, hostip6
=None,
251 invocationid
=names
.invocation
, adminpass
=names
.adminpass
,
252 krbtgtpass
=None, machinepass
=None, dnspass
=None, root
=None,
253 nobody
=None, users
=None,
254 serverrole
="domain controller",
255 backend_type
=None, ldapadminpass
=None, ol_mmr_urls
=None,
257 dom_for_fun_level
=names
.domainlevel
, dns_backend
=names
.dns_backend
,
258 useeadb
=True, use_ntvfs
=True)
262 """Sorts two DNs in the lexicographical order it and put higher level DN
265 So given the dns cn=bar,cn=foo and cn=foo the later will be return as
268 :param x: First object to compare
269 :param y: Second object to compare
271 p
= re
.compile(r
'(?<!\\), ?')
272 tab1
= p
.split(str(x
))
273 tab2
= p
.split(str(y
))
274 minimum
= min(len(tab1
), len(tab2
))
277 # Note: python range go up to upper limit but do not include it
278 for i
in range(0, minimum
):
279 ret
= cmp(tab1
[len1
-i
], tab2
[len2
-i
])
284 assert len1
!=len2
,"PB PB PB" + " ".join(tab1
)+" / " + " ".join(tab2
)
292 def identic_rename(ldbobj
, dn
):
293 """Perform a back and forth rename to trigger renaming on attribute that
294 can't be directly modified.
296 :param lbdobj: An Ldb Object
297 :param dn: DN of the object to manipulate
299 (before
, after
) = str(dn
).split('=', 1)
300 # we need to use relax to avoid the subtree_rename constraints
301 ldbobj
.rename(dn
, ldb
.Dn(ldbobj
, "%s=foo%s" % (before
, after
)), ["relax:0"])
302 ldbobj
.rename(ldb
.Dn(ldbobj
, "%s=foo%s" % (before
, after
)), dn
, ["relax:0"])
306 """Return separate ACE of an ACL
308 :param acl: A string representing the ACL
309 :return: A hash with different parts
312 p
= re
.compile(r
'(\w+)?(\(.*?\))')
320 hash["aces"].append(e
[1])
325 def chunck_sddl(sddl
):
326 """ Return separate parts of the SDDL (owner, group, ...)
328 :param sddl: An string containing the SDDL to chunk
329 :return: A hash with the different chunk
332 p
= re
.compile(r
'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
333 tab
= p
.findall(sddl
)
349 def get_clean_sd(sd
):
350 """Get the SD without difference between 2 sddl
352 This function split the textual representation of ACL into smaller
353 chunck in order to not to report a simple permutation as a difference
355 :param refsddl: First sddl to compare
356 :param cursddl: Second sddl to compare
357 :param checkSacl: If false we skip the sacl checks
358 :return: A string that explain difference between sddls
361 sd_clean
= security
.descriptor()
362 sd_clean
.owner_sid
= sd
.owner_sid
363 sd_clean
.group_sid
= sd
.group_sid
364 sd_clean
.type = sd
.type
365 sd_clean
.revision
= sd
.revision
368 if sd
.sacl
is not None:
370 for i
in range(0, len(aces
)):
373 if not ace
.flags
& security
.SEC_ACE_FLAG_INHERITED_ACE
:
374 sd_clean
.sacl_add(ace
)
378 if sd
.dacl
is not None:
380 for i
in range(0, len(aces
)):
383 if not ace
.flags
& security
.SEC_ACE_FLAG_INHERITED_ACE
:
384 sd_clean
.dacl_add(ace
)
389 def get_diff_sds(refsd
, cursd
, domainsid
, checkSacl
= True):
390 """Get the difference between 2 sd
392 This function split the textual representation of ACL into smaller
393 chunck in order to not to report a simple permutation as a difference
395 :param refsddl: First sddl to compare
396 :param cursddl: Second sddl to compare
397 :param checkSacl: If false we skip the sacl checks
398 :return: A string that explain difference between sddls
401 cursddl
= get_clean_sd(cursd
).as_sddl(domainsid
)
402 refsddl
= get_clean_sd(refsd
).as_sddl(domainsid
)
405 hash_cur
= chunck_sddl(cursddl
)
406 hash_ref
= chunck_sddl(refsddl
)
408 if not hash_cur
.has_key("owner"):
409 txt
= "\tNo owner in current SD"
410 elif hash_cur
["owner"] != hash_ref
["owner"]:
411 txt
= "\tOwner mismatch: %s (in ref) %s" \
412 "(in current)\n" % (hash_ref
["owner"], hash_cur
["owner"])
414 if not hash_cur
.has_key("group"):
415 txt
= "%s\tNo group in current SD" % txt
416 elif hash_cur
["group"] != hash_ref
["group"]:
417 txt
= "%s\tGroup mismatch: %s (in ref) %s" \
418 "(in current)\n" % (txt
, hash_ref
["group"], hash_cur
["group"])
424 if hash_cur
.has_key(part
) and hash_ref
.has_key(part
):
426 # both are present, check if they contain the same ACE
429 c_cur
= chunck_acl(hash_cur
[part
])
430 c_ref
= chunck_acl(hash_ref
[part
])
432 for elem
in c_cur
["aces"]:
435 for elem
in c_ref
["aces"]:
443 if len(h_cur
) + len(h_ref
) > 0:
444 txt
= "%s\tPart %s is different between reference" \
445 " and current here is the detail:\n" % (txt
, part
)
448 txt
= "%s\t\t%s ACE is not present in the" \
449 " reference\n" % (txt
, item
)
452 txt
= "%s\t\t%s ACE is not present in the" \
453 " current\n" % (txt
, item
)
455 elif hash_cur
.has_key(part
) and not hash_ref
.has_key(part
):
456 txt
= "%s\tReference ACL hasn't a %s part\n" % (txt
, part
)
457 elif not hash_cur
.has_key(part
) and hash_ref
.has_key(part
):
458 txt
= "%s\tCurrent ACL hasn't a %s part\n" % (txt
, part
)
463 def update_secrets(newsecrets_ldb
, secrets_ldb
, messagefunc
):
464 """Update secrets.ldb
466 :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
467 of the reference provision
468 :param secrets_ldb: An LDB object that is connected to the secrets.ldb
469 of the updated provision
472 messagefunc(SIMPLE
, "Update of secrets.ldb")
473 reference
= newsecrets_ldb
.search(base
="@MODULES", scope
=SCOPE_BASE
)
474 current
= secrets_ldb
.search(base
="@MODULES", scope
=SCOPE_BASE
)
475 assert reference
, "Reference modules list can not be empty"
476 if len(current
) == 0:
478 delta
= secrets_ldb
.msg_diff(ldb
.Message(), reference
[0])
479 delta
.dn
= reference
[0].dn
480 secrets_ldb
.add(reference
[0])
482 delta
= secrets_ldb
.msg_diff(current
[0], reference
[0])
483 delta
.dn
= current
[0].dn
484 secrets_ldb
.modify(delta
)
486 reference
= newsecrets_ldb
.search(expression
="objectClass=top", base
="",
487 scope
=SCOPE_SUBTREE
, attrs
=["dn"])
488 current
= secrets_ldb
.search(expression
="objectClass=top", base
="",
489 scope
=SCOPE_SUBTREE
, attrs
=["dn"])
495 empty
= ldb
.Message()
496 for i
in range(0, len(reference
)):
497 hash_new
[str(reference
[i
]["dn"]).lower()] = reference
[i
]["dn"]
499 # Create a hash for speeding the search of existing object in the
501 for i
in range(0, len(current
)):
502 hash[str(current
[i
]["dn"]).lower()] = current
[i
]["dn"]
504 for k
in hash_new
.keys():
505 if not hash.has_key(k
):
506 listMissing
.append(hash_new
[k
])
508 listPresent
.append(hash_new
[k
])
510 for entry
in listMissing
:
511 reference
= newsecrets_ldb
.search(expression
="distinguishedName=%s" % entry
,
512 base
="", scope
=SCOPE_SUBTREE
)
513 current
= secrets_ldb
.search(expression
="distinguishedName=%s" % entry
,
514 base
="", scope
=SCOPE_SUBTREE
)
515 delta
= secrets_ldb
.msg_diff(empty
, reference
[0])
516 for att
in hashAttrNotCopied
:
518 messagefunc(CHANGE
, "Entry %s is missing from secrets.ldb" %
521 messagefunc(CHANGE
, " Adding attribute %s" % att
)
522 delta
.dn
= reference
[0].dn
523 secrets_ldb
.add(delta
)
525 for entry
in listPresent
:
526 reference
= newsecrets_ldb
.search(expression
="distinguishedName=%s" % entry
,
527 base
="", scope
=SCOPE_SUBTREE
)
528 current
= secrets_ldb
.search(expression
="distinguishedName=%s" % entry
, base
="",
530 delta
= secrets_ldb
.msg_diff(current
[0], reference
[0])
531 for att
in hashAttrNotCopied
:
535 messagefunc(CHANGE
, "Found attribute name on %s,"
536 " must rename the DN" % (current
[0].dn
))
537 identic_rename(secrets_ldb
, reference
[0].dn
)
541 for entry
in listPresent
:
542 reference
= newsecrets_ldb
.search(expression
="distinguishedName=%s" % entry
, base
="",
544 current
= secrets_ldb
.search(expression
="distinguishedName=%s" % entry
, base
="",
546 delta
= secrets_ldb
.msg_diff(current
[0], reference
[0])
547 for att
in hashAttrNotCopied
:
550 if att
== "msDS-KeyVersionNumber":
554 "Adding/Changing attribute %s to %s" %
555 (att
, current
[0].dn
))
557 delta
.dn
= current
[0].dn
558 secrets_ldb
.modify(delta
)
560 res2
= secrets_ldb
.search(expression
="(samaccountname=dns)",
561 scope
=SCOPE_SUBTREE
, attrs
=["dn"])
564 messagefunc(SIMPLE
, "Remove old dns account")
565 secrets_ldb
.delete(res2
[0]["dn"])
568 def getOEMInfo(samdb
, rootdn
):
569 """Return OEM Information on the top level Samba4 use to store version
572 :param samdb: An LDB object connect to sam.ldb
573 :param rootdn: Root DN of the domain
574 :return: The content of the field oEMInformation (if any)
576 res
= samdb
.search(expression
="(objectClass=*)", base
=str(rootdn
),
577 scope
=SCOPE_BASE
, attrs
=["dn", "oEMInformation"])
578 if len(res
) > 0 and res
[0].get("oEMInformation"):
579 info
= res
[0]["oEMInformation"]
585 def updateOEMInfo(samdb
, rootdn
):
586 """Update the OEMinfo field to add information about upgrade
588 :param samdb: an LDB object connected to the sam DB
589 :param rootdn: The string representation of the root DN of
590 the provision (ie. DC=...,DC=...)
592 res
= samdb
.search(expression
="(objectClass=*)", base
=rootdn
,
593 scope
=SCOPE_BASE
, attrs
=["dn", "oEMInformation"])
595 if res
[0].get("oEMInformation"):
596 info
= str(res
[0]["oEMInformation"])
599 info
= "%s, upgrade to %s" % (info
, version
)
600 delta
= ldb
.Message()
601 delta
.dn
= ldb
.Dn(samdb
, str(res
[0]["dn"]))
602 delta
["oEMInformation"] = ldb
.MessageElement(info
, ldb
.FLAG_MOD_REPLACE
,
606 def update_gpo(paths
, samdb
, names
, lp
, message
):
607 """Create missing GPO file object if needed
609 dir = getpolicypath(paths
.sysvol
, names
.dnsdomain
, names
.policyid
)
610 if not os
.path
.isdir(dir):
611 create_gpo_struct(dir)
613 if names
.policyid_dc
is None:
614 raise ProvisioningError("Policy ID for Domain controller is missing")
615 dir = getpolicypath(paths
.sysvol
, names
.dnsdomain
, names
.policyid_dc
)
616 if not os
.path
.isdir(dir):
617 create_gpo_struct(dir)
619 def increment_calculated_keyversion_number(samdb
, rootdn
, hashDns
):
620 """For a given hash associating dn and a number, this function will
621 update the replPropertyMetaData of each dn in the hash, so that the
622 calculated value of the msDs-KeyVersionNumber is equal or superior to the
623 one associated to the given dn.
625 :param samdb: An SamDB object pointing to the sam
626 :param rootdn: The base DN where we want to start
627 :param hashDns: A hash with dn as key and number representing the
628 minimum value of msDs-KeyVersionNumber that we want to
631 entry
= samdb
.search(expression
='(objectClass=user)',
632 base
=ldb
.Dn(samdb
,str(rootdn
)),
633 scope
=SCOPE_SUBTREE
, attrs
=["msDs-KeyVersionNumber"],
634 controls
=["search_options:1:2"])
638 raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
641 if hashDns
.has_key(str(e
.dn
).lower()):
642 val
= e
.get("msDs-KeyVersionNumber")
645 version
= int(str(hashDns
[str(e
.dn
).lower()]))
646 if int(str(val
)) < version
:
648 samdb
.set_attribute_replmetadata_version(str(e
.dn
),
651 def delta_update_basesamdb(refsampath
, sampath
, creds
, session
, lp
, message
):
652 """Update the provision container db: sam.ldb
653 This function is aimed for alpha9 and newer;
655 :param refsampath: Path to the samdb in the reference provision
656 :param sampath: Path to the samdb in the upgraded provision
657 :param creds: Credential used for openning LDB files
658 :param session: Session to use for openning LDB files
659 :param lp: A loadparam object
660 :return: A msg_diff object with the difference between the @ATTRIBUTES
661 of the current provision and the reference provision
665 "Update base samdb by searching difference with reference one")
666 refsam
= Ldb(refsampath
, session_info
=session
, credentials
=creds
,
667 lp
=lp
, options
=["modules:"])
668 sam
= Ldb(sampath
, session_info
=session
, credentials
=creds
, lp
=lp
,
669 options
=["modules:"])
671 empty
= ldb
.Message()
673 reference
= refsam
.search(expression
="")
675 for refentry
in reference
:
676 entry
= sam
.search(expression
="distinguishedName=%s" % refentry
["dn"],
679 delta
= sam
.msg_diff(empty
, refentry
)
680 message(CHANGE
, "Adding %s to sam db" % str(refentry
.dn
))
681 if str(refentry
.dn
) == "@PROVISION" and\
682 delta
.get(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
):
683 delta
.remove(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
)
684 delta
.dn
= refentry
.dn
687 delta
= sam
.msg_diff(entry
[0], refentry
)
688 if str(refentry
.dn
) == "@ATTRIBUTES":
689 deltaattr
= sam
.msg_diff(refentry
, entry
[0])
690 if str(refentry
.dn
) == "@PROVISION" and\
691 delta
.get(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
):
692 delta
.remove(samba
.provision
.LAST_PROVISION_USN_ATTRIBUTE
)
693 if len(delta
.items()) > 1:
694 delta
.dn
= refentry
.dn
700 def construct_existor_expr(attrs
):
701 """Construct a exists or LDAP search expression.
703 :param attrs: List of attribute on which we want to create the search
705 :return: A string representing the expression, if attrs is empty an
706 empty string is returned
712 expr
= "%s(%s=*)"%(expr
,att
)
716 def update_machine_account_password(samdb
, secrets_ldb
, names
):
717 """Update (change) the password of the current DC both in the SAM db and in
720 :param samdb: An LDB object related to the sam.ldb file of a given provision
721 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
723 :param names: List of key provision parameters"""
725 expression
= "samAccountName=%s$" % names
.netbiosname
726 secrets_msg
= secrets_ldb
.search(expression
=expression
,
727 attrs
=["secureChannelType"])
728 if int(secrets_msg
[0]["secureChannelType"][0]) == SEC_CHAN_BDC
:
729 res
= samdb
.search(expression
=expression
, attrs
=[])
730 assert(len(res
) == 1)
732 msg
= ldb
.Message(res
[0].dn
)
733 machinepass
= samba
.generate_random_password(128, 255)
734 mputf16
= machinepass
.encode('utf-16-le')
735 msg
["clearTextPassword"] = ldb
.MessageElement(mputf16
,
736 ldb
.FLAG_MOD_REPLACE
,
740 res
= samdb
.search(expression
=("samAccountName=%s$" % names
.netbiosname
),
741 attrs
=["msDs-keyVersionNumber"])
742 assert(len(res
) == 1)
743 kvno
= int(str(res
[0]["msDs-keyVersionNumber"]))
744 secChanType
= int(secrets_msg
[0]["secureChannelType"][0])
746 secretsdb_self_join(secrets_ldb
, domain
=names
.domain
,
748 domainsid
=names
.domainsid
,
749 dnsdomain
=names
.dnsdomain
,
750 netbiosname
=names
.netbiosname
,
751 machinepass
=machinepass
,
752 key_version_number
=kvno
,
753 secure_channel_type
=secChanType
)
755 raise ProvisioningError("Unable to find a Secure Channel"
756 "of type SEC_CHAN_BDC")
758 def update_dns_account_password(samdb
, secrets_ldb
, names
):
759 """Update (change) the password of the dns both in the SAM db and in
762 :param samdb: An LDB object related to the sam.ldb file of a given provision
763 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
765 :param names: List of key provision parameters"""
767 expression
= "samAccountName=dns-%s" % names
.netbiosname
768 secrets_msg
= secrets_ldb
.search(expression
=expression
)
769 if len(secrets_msg
) == 1:
770 res
= samdb
.search(expression
=expression
, attrs
=[])
771 assert(len(res
) == 1)
773 msg
= ldb
.Message(res
[0].dn
)
774 machinepass
= samba
.generate_random_password(128, 255)
775 mputf16
= machinepass
.encode('utf-16-le')
776 msg
["clearTextPassword"] = ldb
.MessageElement(mputf16
,
777 ldb
.FLAG_MOD_REPLACE
,
782 res
= samdb
.search(expression
=expression
,
783 attrs
=["msDs-keyVersionNumber"])
784 assert(len(res
) == 1)
785 kvno
= str(res
[0]["msDs-keyVersionNumber"])
787 msg
= ldb
.Message(secrets_msg
[0].dn
)
788 msg
["secret"] = ldb
.MessageElement(machinepass
,
789 ldb
.FLAG_MOD_REPLACE
,
791 msg
["msDS-KeyVersionNumber"] = ldb
.MessageElement(kvno
,
792 ldb
.FLAG_MOD_REPLACE
,
793 "msDS-KeyVersionNumber")
795 secrets_ldb
.modify(msg
)
797 def search_constructed_attrs_stored(samdb
, rootdn
, attrs
):
798 """Search a given sam DB for calculated attributes that are
799 still stored in the db.
801 :param samdb: An LDB object pointing to the sam
802 :param rootdn: The base DN where the search should start
803 :param attrs: A list of attributes to be searched
804 :return: A hash with attributes as key and an array of
805 array. Each array contains the dn and the associated
806 values for this attribute as they are stored in the
810 expr
= construct_existor_expr(attrs
)
813 entry
= samdb
.search(expression
=expr
, base
=ldb
.Dn(samdb
, str(rootdn
)),
814 scope
=SCOPE_SUBTREE
, attrs
=attrs
,
815 controls
=["search_options:1:2","bypassoperational:0"])
823 if hashAtt
.has_key(att
):
824 hashAtt
[att
][str(ent
.dn
).lower()] = str(ent
[att
])
827 hashAtt
[att
][str(ent
.dn
).lower()] = str(ent
[att
])
831 def findprovisionrange(samdb
, basedn
):
832 """ Find ranges of usn grouped by invocation id and then by timestamp
835 :param samdb: An LDB object pointing to the samdb
836 :param basedn: The DN of the forest
838 :return: A two level dictionary with invoication id as the
839 first level, timestamp as the second one and then
840 max, min, and number as subkeys, representing respectivily
841 the maximum usn for the range, the minimum usn and the number
842 of object with usn in this range.
847 res
= samdb
.search(base
=basedn
, expression
="objectClass=*",
848 scope
=ldb
.SCOPE_SUBTREE
,
849 attrs
=["replPropertyMetaData"],
850 controls
=["search_options:1:2"])
854 obj
= ndr_unpack(drsblobs
.replPropertyMetaDataBlob
,
855 str(e
["replPropertyMetaData"])).ctr
858 # like a timestamp but with the resolution of 1 minute
859 minutestamp
=_glue
.nttime2unix(o
.originating_change_time
)/60
860 hash_ts
= hash_id
.get(str(o
.originating_invocation_id
))
864 ob
["min"] = o
.originating_usn
865 ob
["max"] = o
.originating_usn
867 ob
["list"] = [str(e
.dn
)]
870 ob
= hash_ts
.get(minutestamp
)
873 ob
["min"] = o
.originating_usn
874 ob
["max"] = o
.originating_usn
876 ob
["list"] = [str(e
.dn
)]
878 if ob
["min"] > o
.originating_usn
:
879 ob
["min"] = o
.originating_usn
880 if ob
["max"] < o
.originating_usn
:
881 ob
["max"] = o
.originating_usn
882 if not (str(e
.dn
) in ob
["list"]):
883 ob
["num"] = ob
["num"] + 1
884 ob
["list"].append(str(e
.dn
))
885 hash_ts
[minutestamp
] = ob
886 hash_id
[str(o
.originating_invocation_id
)] = hash_ts
888 return (hash_id
, nb_obj
)
890 def print_provision_ranges(dic
, limit_print
, dest
, samdb_path
, invocationid
):
891 """ print the differents ranges passed as parameter
893 :param dic: A dictionnary as returned by findprovisionrange
894 :param limit_print: minimum number of object in a range in order to print it
895 :param dest: Destination directory
896 :param samdb_path: Path to the sam.ldb file
897 :param invoicationid: Invocation ID for the current provision
904 sorted_keys
.extend(hash_ts
.keys())
908 for k
in sorted_keys
:
910 if obj
["num"] > limit_print
:
911 dt
= _glue
.nttime2string(_glue
.unix2nttime(k
*60))
912 print "%s # of modification: %d \tmin: %d max: %d" % (dt
, obj
["num"],
915 if hash_ts
[k
]["num"] > 600:
916 kept_record
.append(k
)
918 # Let's try to concatenate consecutive block if they are in the almost same minutestamp
919 for i
in range(0, len(kept_record
)):
921 key1
= kept_record
[i
]
922 key2
= kept_record
[i
-1]
924 # previous record is just 1 minute away from current
925 if int(hash_ts
[key1
]["min"]) == int(hash_ts
[key2
]["max"]) + 1:
926 # Copy the highest USN in the previous record
927 # and mark the current as skipped
928 hash_ts
[key2
]["max"] = hash_ts
[key1
]["max"]
929 hash_ts
[key1
]["skipped"] = True
931 for k
in kept_record
:
933 if obj
.get("skipped") is None:
934 ldif
= "%slastProvisionUSN: %d-%d;%s\n" % (ldif
, obj
["min"],
938 file = tempfile
.mktemp(dir=dest
, prefix
="usnprov", suffix
=".ldif")
940 print "To track the USNs modified/created by provision and upgrade proivsion,"
941 print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
942 print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
943 print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path
),file)
944 ldif
= "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid
, ldif
)
945 open(file,'w').write(ldif
)
947 def int64range2str(value
):
948 """Display the int64 range stored in value as xxx-yyy
950 :param value: The int64 range
951 :return: A string of the representation of the range
955 str = "%d-%d" % (lvalue
&0xFFFFFFFF, lvalue
>>32)