python/samba/netcmd/ldapcmp.py

   1 # Unix SMB/CIFS implementation.
   2 # A command to compare differences of objects and attributes between
   3 # two LDAP servers both running at the same time. It generally compares
   4 # one of the three pratitions DOMAIN, CONFIGURATION or SCHEMA. Users
   5 # that have to be provided sheould be able to read objects in any of the
   6 # above partitions.
   7
   8 # Copyright (C) Zahari Zahariev <zahari.zahariev@postpath.com> 2009, 2010
   9 #
  10 # This program is free software; you can redistribute it and/or modify
  11 # it under the terms of the GNU General Public License as published by
  12 # the Free Software Foundation; either version 3 of the License, or
  13 # (at your option) any later version.
  14 #
  15 # This program is distributed in the hope that it will be useful,
  16 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 # GNU General Public License for more details.
  19 #
  20 # You should have received a copy of the GNU General Public License
  21 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 #
  23
  24 import os
  25 import re
  26 import sys
  27
  28 import samba
  29 import samba.getopt as options
  30 from samba import Ldb
  31 from samba.ndr import ndr_unpack
  32 from samba.dcerpc import security
  33 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, ERR_NO_SUCH_OBJECT, LdbError
  34 from samba.netcmd import (
  35     Command,
  36     CommandError,
  37     Option,
  38 )
  39
  40
  41 class LDAPBase(object):
  42
  43     def __init__(self, host, creds, lp,
  44                  two=False, quiet=False, descriptor=False, sort_aces=False, verbose=False,
  45                  view="section", base="", scope="SUB",
  46                  outf=sys.stdout, errf=sys.stderr, skip_missing_dn=True):
  47         ldb_options = []
  48         samdb_url = host
  49         if "://" not in host:
  50             if os.path.isfile(host):
  51                 samdb_url = "tdb://%s" % host
  52             else:
  53                 samdb_url = "ldap://%s" % host
  54         # use 'paged_search' module when connecting remotely
  55         if samdb_url.lower().startswith("ldap://"):
  56             ldb_options = ["modules:paged_searches"]
  57         self.outf = outf
  58         self.errf = errf
  59         self.ldb = Ldb(url=samdb_url,
  60                        credentials=creds,
  61                        lp=lp,
  62                        options=ldb_options)
  63         self.search_base = base
  64         self.search_scope = scope
  65         self.two_domains = two
  66         self.quiet = quiet
  67         self.descriptor = descriptor
  68         self.sort_aces = sort_aces
  69         self.view = view
  70         self.verbose = verbose
  71         self.host = host
  72         self.skip_missing_dn = skip_missing_dn
  73         self.base_dn = str(self.ldb.get_default_basedn())
  74         self.root_dn = str(self.ldb.get_root_basedn())
  75         self.config_dn = str(self.ldb.get_config_basedn())
  76         self.schema_dn = str(self.ldb.get_schema_basedn())
  77         self.domain_netbios = self.find_netbios()
  78         self.server_names = self.find_servers()
  79         self.domain_name = re.sub("[Dd][Cc]=", "", self.base_dn).replace(",", ".")
  80         self.domain_sid = self.find_domain_sid()
  81         self.get_sid_map()
  82         #
  83         # Log some domain controller specific place-holers that are being used
  84         # when compare content of two DCs. Uncomment for DEBUG purposes.
  85         if self.two_domains and not self.quiet:
  86             self.outf.write("\n* Place-holders for %s:\n" % self.host)
  87             self.outf.write(4 * " " + "${DOMAIN_DN}      => %s\n" %
  88                             self.base_dn)
  89             self.outf.write(4 * " " + "${DOMAIN_NETBIOS} => %s\n" %
  90                             self.domain_netbios)
  91             self.outf.write(4 * " " + "${SERVER_NAME}     => %s\n" %
  92                             self.server_names)
  93             self.outf.write(4 * " " + "${DOMAIN_NAME}    => %s\n" %
  94                             self.domain_name)
  95
  96     def find_domain_sid(self):
  97         res = self.ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  98         return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
  99
 100     def find_servers(self):
 101         """
 102         """
 103         res = self.ldb.search(base="OU=Domain Controllers,%s" % self.base_dn,
 104                               scope=SCOPE_SUBTREE, expression="(objectClass=computer)", attrs=["cn"])
 105         assert len(res) > 0
 106         srv = []
 107         for x in res:
 108             srv.append(str(x["cn"][0]))
 109         return srv
 110
 111     def find_netbios(self):
 112         res = self.ldb.search(base="CN=Partitions,%s" % self.config_dn,
 113                               scope=SCOPE_SUBTREE, attrs=["nETBIOSName"])
 114         assert len(res) > 0
 115         for x in res:
 116             if "nETBIOSName" in x.keys():
 117                 return x["nETBIOSName"][0]
 118
 119     def object_exists(self, object_dn):
 120         res = None
 121         try:
 122             res = self.ldb.search(base=object_dn, scope=SCOPE_BASE)
 123         except LdbError as e2:
 124             (enum, estr) = e2.args
 125             if enum == ERR_NO_SUCH_OBJECT:
 126                 return False
 127             raise
 128         return len(res) == 1
 129
 130     def delete_force(self, object_dn):
 131         try:
 132             self.ldb.delete(object_dn)
 133         except Ldb.LdbError as e:
 134             assert "No such object" in str(e)
 135
 136     def get_attribute_name(self, key):
 137         """ Returns the real attribute name
 138             It resolved ranged results e.g. member;range=0-1499
 139         """
 140
 141         r = re.compile("^([^;]+);range=(\d+)-(\d+|\*)$")
 142
 143         m = r.match(key)
 144         if m is None:
 145             return key
 146
 147         return m.group(1)
 148
 149     def get_attribute_values(self, object_dn, key, vals):
 150         """ Returns list with all attribute values
 151             It resolved ranged results e.g. member;range=0-1499
 152         """
 153
 154         r = re.compile("^([^;]+);range=(\d+)-(\d+|\*)$")
 155
 156         m = r.match(key)
 157         if m is None:
 158             # no range, just return the values
 159             return vals
 160
 161         attr = m.group(1)
 162         hi = int(m.group(3))
 163
 164         # get additional values in a loop
 165         # until we get a response with '*' at the end
 166         while True:
 167
 168             n = "%s;range=%d-*" % (attr, hi + 1)
 169             res = self.ldb.search(base=object_dn, scope=SCOPE_BASE, attrs=[n])
 170             assert len(res) == 1
 171             res = dict(res[0])
 172             del res["dn"]
 173
 174             fm = None
 175             fvals = None
 176
 177             for key in res.keys():
 178                 m = r.match(key)
 179
 180                 if m is None:
 181                     continue
 182
 183                 if m.group(1) != attr:
 184                     continue
 185
 186                 fm = m
 187                 fvals = list(res[key])
 188                 break
 189
 190             if fm is None:
 191                 break
 192
 193             vals.extend(fvals)
 194             if fm.group(3) == "*":
 195                 # if we got "*" we're done
 196                 break
 197
 198             assert int(fm.group(2)) == hi + 1
 199             hi = int(fm.group(3))
 200
 201         return vals
 202
 203     def get_attributes(self, object_dn):
 204         """ Returns dict with all default visible attributes
 205         """
 206         res = self.ldb.search(base=object_dn, scope=SCOPE_BASE, attrs=["*"])
 207         assert len(res) == 1
 208         res = dict(res[0])
 209         # 'Dn' element is not iterable and we have it as 'distinguishedName'
 210         del res["dn"]
 211         for key in list(res.keys()):
 212             vals = list(res[key])
 213             del res[key]
 214             name = self.get_attribute_name(key)
 215             res[name] = self.get_attribute_values(object_dn, key, vals)
 216
 217         return res
 218
 219     def get_descriptor_sddl(self, object_dn):
 220         res = self.ldb.search(base=object_dn, scope=SCOPE_BASE, attrs=["nTSecurityDescriptor"])
 221         desc = res[0]["nTSecurityDescriptor"][0]
 222         desc = ndr_unpack(security.descriptor, desc)
 223         return desc.as_sddl(self.domain_sid)
 224
 225     def guid_as_string(self, guid_blob):
 226         """ Translate binary representation of schemaIDGUID to standard string representation.
 227             @gid_blob: binary schemaIDGUID
 228         """
 229         blob = "%s" % guid_blob
 230         stops = [4, 2, 2, 2, 6]
 231         index = 0
 232         res = ""
 233         x = 0
 234         while x < len(stops):
 235             tmp = ""
 236             y = 0
 237             while y < stops[x]:
 238                 c = hex(ord(blob[index])).replace("0x", "")
 239                 c = [None, "0" + c, c][len(c)]
 240                 if 2 * index < len(blob):
 241                     tmp = c + tmp
 242                 else:
 243                     tmp += c
 244                 index += 1
 245                 y += 1
 246             res += tmp + " "
 247             x += 1
 248         assert index == len(blob)
 249         return res.strip().replace(" ", "-")
 250
 251     def get_sid_map(self):
 252         """ Build dictionary that maps GUID to 'name' attribute found in Schema or Extended-Rights.
 253         """
 254         self.sid_map = {}
 255         res = self.ldb.search(base=self.base_dn,
 256                               expression="(objectSid=*)", scope=SCOPE_SUBTREE, attrs=["objectSid", "sAMAccountName"])
 257         for item in res:
 258             try:
 259                 self.sid_map["%s" % ndr_unpack(security.dom_sid, item["objectSid"][0])] = str(item["sAMAccountName"][0])
 260             except KeyError:
 261                 pass
 262
 263
 264 class Descriptor(object):
 265     def __init__(self, connection, dn, outf=sys.stdout, errf=sys.stderr):
 266         self.outf = outf
 267         self.errf = errf
 268         self.con = connection
 269         self.dn = dn
 270         self.sddl = self.con.get_descriptor_sddl(self.dn)
 271         self.dacl_list = self.extract_dacl()
 272         if self.con.sort_aces:
 273             self.dacl_list.sort()
 274
 275     def extract_dacl(self):
 276         """ Extracts the DACL as a list of ACE string (with the brakets).
 277         """
 278         try:
 279             if "S:" in self.sddl:
 280                 res = re.search("D:(.*?)(\(.*?\))S:", self.sddl).group(2)
 281             else:
 282                 res = re.search("D:(.*?)(\(.*\))", self.sddl).group(2)
 283         except AttributeError:
 284             return []
 285         return re.findall("(\(.*?\))", res)
 286
 287     def fix_sid(self, ace):
 288         res = "%s" % ace
 289         sids = re.findall("S-[-0-9]+", res)
 290         # If there are not SIDs to replace return the same ACE
 291         if len(sids) == 0:
 292             return res
 293         for sid in sids:
 294             try:
 295                 name = self.con.sid_map[sid]
 296                 res = res.replace(sid, name)
 297             except KeyError:
 298                 # Do not bother if the SID is not found in baseDN
 299                 pass
 300         return res
 301
 302     def diff_1(self, other):
 303         res = ""
 304         if len(self.dacl_list) != len(other.dacl_list):
 305             res += 4 * " " + "Difference in ACE count:\n"
 306             res += 8 * " " + "=> %s\n" % len(self.dacl_list)
 307             res += 8 * " " + "=> %s\n" % len(other.dacl_list)
 308         #
 309         i = 0
 310         flag = True
 311         while True:
 312             self_ace = None
 313             other_ace = None
 314             try:
 315                 self_ace = "%s" % self.dacl_list[i]
 316             except IndexError:
 317                 self_ace = ""
 318             #
 319             try:
 320                 other_ace = "%s" % other.dacl_list[i]
 321             except IndexError:
 322                 other_ace = ""
 323             if len(self_ace) + len(other_ace) == 0:
 324                 break
 325             self_ace_fixed = "%s" % self.fix_sid(self_ace)
 326             other_ace_fixed = "%s" % other.fix_sid(other_ace)
 327             if self_ace_fixed != other_ace_fixed:
 328                 res += "%60s * %s\n" % (self_ace_fixed, other_ace_fixed)
 329                 flag = False
 330             else:
 331                 res += "%60s | %s\n" % (self_ace_fixed, other_ace_fixed)
 332             i += 1
 333         return (flag, res)
 334
 335     def diff_2(self, other):
 336         res = ""
 337         if len(self.dacl_list) != len(other.dacl_list):
 338             res += 4 * " " + "Difference in ACE count:\n"
 339             res += 8 * " " + "=> %s\n" % len(self.dacl_list)
 340             res += 8 * " " + "=> %s\n" % len(other.dacl_list)
 341         #
 342         common_aces = []
 343         self_aces = []
 344         other_aces = []
 345         self_dacl_list_fixed = []
 346         other_dacl_list_fixed = []
 347         [self_dacl_list_fixed.append(self.fix_sid(ace)) for ace in self.dacl_list]
 348         [other_dacl_list_fixed.append(other.fix_sid(ace)) for ace in other.dacl_list]
 349         for ace in self_dacl_list_fixed:
 350             try:
 351                 other_dacl_list_fixed.index(ace)
 352             except ValueError:
 353                 self_aces.append(ace)
 354             else:
 355                 common_aces.append(ace)
 356         self_aces = sorted(self_aces)
 357         if len(self_aces) > 0:
 358             res += 4 * " " + "ACEs found only in %s:\n" % self.con.host
 359             for ace in self_aces:
 360                 res += 8 * " " + ace + "\n"
 361         #
 362         for ace in other_dacl_list_fixed:
 363             try:
 364                 self_dacl_list_fixed.index(ace)
 365             except ValueError:
 366                 other_aces.append(ace)
 367             else:
 368                 common_aces.append(ace)
 369         other_aces = sorted(other_aces)
 370         if len(other_aces) > 0:
 371             res += 4 * " " + "ACEs found only in %s:\n" % other.con.host
 372             for ace in other_aces:
 373                 res += 8 * " " + ace + "\n"
 374         #
 375         common_aces = sorted(list(set(common_aces)))
 376         if self.con.verbose:
 377             res += 4 * " " + "ACEs found in both:\n"
 378             for ace in common_aces:
 379                 res += 8 * " " + ace + "\n"
 380         return (self_aces == [] and other_aces == [], res)
 381
 382
 383 class LDAPObject(object):
 384     def __init__(self, connection, dn, summary, filter_list,
 385                  outf=sys.stdout, errf=sys.stderr):
 386         self.outf = outf
 387         self.errf = errf
 388         self.con = connection
 389         self.two_domains = self.con.two_domains
 390         self.quiet = self.con.quiet
 391         self.verbose = self.con.verbose
 392         self.summary = summary
 393         self.dn = dn.replace("${DOMAIN_DN}", self.con.base_dn)
 394         self.dn = self.dn.replace("CN=${DOMAIN_NETBIOS}", "CN=%s" % self.con.domain_netbios)
 395         for x in self.con.server_names:
 396             self.dn = self.dn.replace("CN=${SERVER_NAME}", "CN=%s" % x)
 397         self.attributes = self.con.get_attributes(self.dn)
 398         # One domain - two domain controllers
 399         #
 400         # Some attributes are defined as FLAG_ATTR_NOT_REPLICATED
 401         #
 402         # The following list was generated by
 403         # egrep '^systemFlags: |^ldapDisplayName: |^linkID: ' \
 404         #       source4/setup/ad-schema/MS-AD_Schema_2K8_R2_Attributes.txt | \
 405         #       grep -B1 FLAG_ATTR_NOT_REPLICATED | \
 406         #       grep ldapDisplayName | \
 407         #       cut -d ' ' -f2
 408         self.non_replicated_attributes = [
 409                 "badPasswordTime",
 410                 "badPwdCount",
 411                 "dSCorePropagationData",
 412                 "lastLogoff",
 413                 "lastLogon",
 414                 "logonCount",
 415                 "modifiedCount",
 416                 "msDS-Cached-Membership",
 417                 "msDS-Cached-Membership-Time-Stamp",
 418                 "msDS-EnabledFeatureBL",
 419                 "msDS-ExecuteScriptPassword",
 420                 "msDS-NcType",
 421                 "msDS-ReplicationEpoch",
 422                 "msDS-RetiredReplNCSignatures",
 423                 "msDS-USNLastSyncSuccess",
 424                 # "distinguishedName", # This is implicitly replicated
 425                 # "objectGUID", # This is implicitly replicated
 426                 "partialAttributeDeletionList",
 427                 "partialAttributeSet",
 428                 "pekList",
 429                 "prefixMap",
 430                 "replPropertyMetaData",
 431                 "replUpToDateVector",
 432                 "repsFrom",
 433                 "repsTo",
 434                 "rIDNextRID",
 435                 "rIDPreviousAllocationPool",
 436                 "schemaUpdate",
 437                 "serverState",
 438                 "subRefs",
 439                 "uSNChanged",
 440                 "uSNCreated",
 441                 "uSNLastObjRem",
 442                 "whenChanged",  # This is implicitly replicated, but may diverge on updates of non-replicated attributes
 443         ]
 444         self.ignore_attributes = self.non_replicated_attributes
 445         self.ignore_attributes += ["msExchServer1HighestUSN"]
 446         if filter_list:
 447             self.ignore_attributes += filter_list
 448
 449         self.dn_attributes = []
 450         self.domain_attributes = []
 451         self.servername_attributes = []
 452         self.netbios_attributes = []
 453         self.other_attributes = []
 454         # Two domains - two domain controllers
 455
 456         if self.two_domains:
 457             self.ignore_attributes += [
 458                 "objectCategory", "objectGUID", "objectSid", "whenCreated",
 459                 "whenChanged", "pwdLastSet", "uSNCreated", "creationTime",
 460                 "modifiedCount", "priorSetTime", "rIDManagerReference",
 461                 "gPLink", "ipsecNFAReference", "fRSPrimaryMember",
 462                 "fSMORoleOwner", "masteredBy", "ipsecOwnersReference",
 463                 "wellKnownObjects", "otherWellKnownObjects", "badPwdCount",
 464                 "ipsecISAKMPReference", "ipsecFilterReference",
 465                 "msDs-masteredBy", "lastSetTime",
 466                 "ipsecNegotiationPolicyReference", "subRefs", "gPCFileSysPath",
 467                 "accountExpires", "invocationId", "operatingSystemVersion",
 468                 "oEMInformation",
 469                 # After Exchange preps
 470                 "targetAddress", "msExchMailboxGuid", "siteFolderGUID"]
 471             #
 472             # Attributes that contain the unique DN tail part e.g. 'DC=samba,DC=org'
 473             self.dn_attributes = [
 474                 "distinguishedName", "defaultObjectCategory", "member", "memberOf", "siteList", "nCName",
 475                 "homeMDB", "homeMTA", "interSiteTopologyGenerator", "serverReference",
 476                 "msDS-HasInstantiatedNCs", "hasMasterNCs", "msDS-hasMasterNCs", "msDS-HasDomainNCs", "dMDLocation",
 477                 "msDS-IsDomainFor", "rIDSetReferences", "serverReferenceBL",
 478                 # After Exchange preps
 479                 "msExchHomeRoutingGroup", "msExchResponsibleMTAServer", "siteFolderServer", "msExchRoutingMasterDN",
 480                 "msExchRoutingGroupMembersBL", "homeMDBBL", "msExchHomePublicMDB", "msExchOwningServer", "templateRoots",
 481                 "addressBookRoots", "msExchPolicyRoots", "globalAddressList", "msExchOwningPFTree",
 482                 "msExchResponsibleMTAServerBL", "msExchOwningPFTreeBL",
 483                 # After 2012 R2 functional preparation
 484                 "msDS-MembersOfResourcePropertyListBL",
 485                 "msDS-ValueTypeReference",
 486                 "msDS-MembersOfResourcePropertyList",
 487                 "msDS-ValueTypeReferenceBL",
 488                 "msDS-ClaimTypeAppliesToClass",
 489             ]
 490             self.dn_attributes = [x.upper() for x in self.dn_attributes]
 491             #
 492             # Attributes that contain the Domain name e.g. 'samba.org'
 493             self.domain_attributes = [
 494                 "proxyAddresses", "mail", "userPrincipalName", "msExchSmtpFullyQualifiedDomainName",
 495                 "dnsHostName", "networkAddress", "dnsRoot", "servicePrincipalName", ]
 496             self.domain_attributes = [x.upper() for x in self.domain_attributes]
 497             #
 498             # May contain DOMAIN_NETBIOS and SERVER_NAME
 499             self.servername_attributes = ["distinguishedName", "name", "CN", "sAMAccountName", "dNSHostName",
 500                                           "servicePrincipalName", "rIDSetReferences", "serverReference", "serverReferenceBL",
 501                                           "msDS-IsDomainFor", "interSiteTopologyGenerator", ]
 502             self.servername_attributes = [x.upper() for x in self.servername_attributes]
 503             #
 504             self.netbios_attributes = ["servicePrincipalName", "CN", "distinguishedName", "nETBIOSName", "name", ]
 505             self.netbios_attributes = [x.upper() for x in self.netbios_attributes]
 506             #
 507             self.other_attributes = ["name", "DC", ]
 508             self.other_attributes = [x.upper() for x in self.other_attributes]
 509         #
 510         self.ignore_attributes = [x.upper() for x in self.ignore_attributes]
 511
 512     def log(self, msg):
 513         """
 514         Log on the screen if there is no --quiet option set
 515         """
 516         if not self.quiet:
 517             self.outf.write(msg +"\n")
 518
 519     def fix_dn(self, s):
 520         res = "%s" % s
 521         if not self.two_domains:
 522             return res
 523         if res.upper().endswith(self.con.base_dn.upper()):
 524             res = res[:len(res) - len(self.con.base_dn)] + "${DOMAIN_DN}"
 525         return res
 526
 527     def fix_domain_name(self, s):
 528         res = "%s" % s
 529         if not self.two_domains:
 530             return res
 531         res = res.replace(self.con.domain_name.lower(), self.con.domain_name.upper())
 532         res = res.replace(self.con.domain_name.upper(), "${DOMAIN_NAME}")
 533         return res
 534
 535     def fix_domain_netbios(self, s):
 536         res = "%s" % s
 537         if not self.two_domains:
 538             return res
 539         res = res.replace(self.con.domain_netbios.lower(), self.con.domain_netbios.upper())
 540         res = res.replace(self.con.domain_netbios.upper(), "${DOMAIN_NETBIOS}")
 541         return res
 542
 543     def fix_server_name(self, s):
 544         res = "%s" % s
 545         if not self.two_domains or len(self.con.server_names) > 1:
 546             return res
 547         for x in self.con.server_names:
 548             res = res.upper().replace(x, "${SERVER_NAME}")
 549         return res
 550
 551     def __eq__(self, other):
 552         if self.con.descriptor:
 553             return self.cmp_desc(other)
 554         return self.cmp_attrs(other)
 555
 556     def cmp_desc(self, other):
 557         d1 = Descriptor(self.con, self.dn, outf=self.outf, errf=self.errf)
 558         d2 = Descriptor(other.con, other.dn, outf=self.outf, errf=self.errf)
 559         if self.con.view == "section":
 560             res = d1.diff_2(d2)
 561         elif self.con.view == "collision":
 562             res = d1.diff_1(d2)
 563         else:
 564             raise Exception("Unknown --view option value.")
 565         #
 566         self.screen_output = res[1][:-1]
 567         other.screen_output = res[1][:-1]
 568         #
 569         return res[0]
 570
 571     def cmp_attrs(self, other):
 572         res = ""
 573         self.unique_attrs = []
 574         self.df_value_attrs = []
 575         other.unique_attrs = []
 576         if self.attributes.keys() != other.attributes.keys():
 577             #
 578             title = 4 * " " + "Attributes found only in %s:" % self.con.host
 579             for x in self.attributes.keys():
 580                 if x not in other.attributes.keys() and \
 581                         not x.upper() in [q.upper() for q in other.ignore_attributes]:
 582                     if title:
 583                         res += title + "\n"
 584                         title = None
 585                     res += 8 * " " + x + "\n"
 586                     self.unique_attrs.append(x)
 587             #
 588             title = 4 * " " + "Attributes found only in %s:" % other.con.host
 589             for x in other.attributes.keys():
 590                 if x not in self.attributes.keys() and \
 591                         not x.upper() in [q.upper() for q in self.ignore_attributes]:
 592                     if title:
 593                         res += title + "\n"
 594                         title = None
 595                     res += 8 * " " + x + "\n"
 596                     other.unique_attrs.append(x)
 597         #
 598         missing_attrs = [x.upper() for x in self.unique_attrs]
 599         missing_attrs += [x.upper() for x in other.unique_attrs]
 600         title = 4 * " " + "Difference in attribute values:"
 601         for x in self.attributes.keys():
 602             if x.upper() in self.ignore_attributes or x.upper() in missing_attrs:
 603                 continue
 604             if isinstance(self.attributes[x], list) and isinstance(other.attributes[x], list):
 605                 self.attributes[x] = sorted(self.attributes[x])
 606                 other.attributes[x] = sorted(other.attributes[x])
 607             if self.attributes[x] != other.attributes[x]:
 608                 p = None
 609                 q = None
 610                 m = None
 611                 n = None
 612                 # First check if the difference can be fixed but shunting the first part
 613                 # of the DomainHostName e.g. 'mysamba4.test.local' => 'mysamba4'
 614                 if x.upper() in self.other_attributes:
 615                     p = [self.con.domain_name.split(".")[0] == j for j in self.attributes[x]]
 616                     q = [other.con.domain_name.split(".")[0] == j for j in other.attributes[x]]
 617                     if p == q:
 618                         continue
 619                 # Attribute values that are list that contain DN based values that may differ
 620                 elif x.upper() in self.dn_attributes:
 621                     m = p
 622                     n = q
 623                     if not p and not q:
 624                         m = self.attributes[x]
 625                         n = other.attributes[x]
 626                     p = [self.fix_dn(j) for j in m]
 627                     q = [other.fix_dn(j) for j in n]
 628                     if p == q:
 629                         continue
 630                 # Attributes that contain the Domain name in them
 631                 if x.upper() in self.domain_attributes:
 632                     m = p
 633                     n = q
 634                     if not p and not q:
 635                         m = self.attributes[x]
 636                         n = other.attributes[x]
 637                     p = [self.fix_domain_name(j) for j in m]
 638                     q = [other.fix_domain_name(j) for j in n]
 639                     if p == q:
 640                         continue
 641                 #
 642                 if x.upper() in self.servername_attributes:
 643                     # Attributes with SERVER_NAME
 644                     m = p
 645                     n = q
 646                     if not p and not q:
 647                         m = self.attributes[x]
 648                         n = other.attributes[x]
 649                     p = [self.fix_server_name(j) for j in m]
 650                     q = [other.fix_server_name(j) for j in n]
 651                     if p == q:
 652                         continue
 653                 #
 654                 if x.upper() in self.netbios_attributes:
 655                     # Attributes with NETBIOS Domain name
 656                     m = p
 657                     n = q
 658                     if not p and not q:
 659                         m = self.attributes[x]
 660                         n = other.attributes[x]
 661                     p = [self.fix_domain_netbios(j) for j in m]
 662                     q = [other.fix_domain_netbios(j) for j in n]
 663                     if p == q:
 664                         continue
 665                 #
 666                 if title:
 667                     res += title + "\n"
 668                     title = None
 669                 if p and q:
 670                     res += 8 * " " + x + " => \n%s\n%s" % (p, q) + "\n"
 671                 else:
 672                     res += 8 * " " + x + " => \n%s\n%s" % (self.attributes[x], other.attributes[x]) + "\n"
 673                 self.df_value_attrs.append(x)
 674         #
 675         if self.unique_attrs + other.unique_attrs != []:
 676             assert self.unique_attrs != other.unique_attrs
 677         self.summary["unique_attrs"] += self.unique_attrs
 678         self.summary["df_value_attrs"] += self.df_value_attrs
 679         other.summary["unique_attrs"] += other.unique_attrs
 680         other.summary["df_value_attrs"] += self.df_value_attrs  # they are the same
 681         #
 682         self.screen_output = res[:-1]
 683         other.screen_output = res[:-1]
 684         #
 685         return res == ""
 686
 687
 688 class LDAPBundle(object):
 689
 690     def __init__(self, connection, context, dn_list=None, filter_list=None,
 691                  outf=sys.stdout, errf=sys.stderr):
 692         self.outf = outf
 693         self.errf = errf
 694         self.con = connection
 695         self.two_domains = self.con.two_domains
 696         self.quiet = self.con.quiet
 697         self.verbose = self.con.verbose
 698         self.search_base = self.con.search_base
 699         self.search_scope = self.con.search_scope
 700         self.skip_missing_dn = self.con.skip_missing_dn
 701         self.summary = {}
 702         self.summary["unique_attrs"] = []
 703         self.summary["df_value_attrs"] = []
 704         self.summary["known_ignored_dn"] = []
 705         self.summary["abnormal_ignored_dn"] = []
 706         self.filter_list = filter_list
 707         if dn_list:
 708             self.dn_list = dn_list
 709         elif context.upper() in ["DOMAIN", "CONFIGURATION", "SCHEMA", "DNSDOMAIN", "DNSFOREST"]:
 710             self.context = context.upper()
 711             self.dn_list = self.get_dn_list(context)
 712         else:
 713             raise Exception("Unknown initialization data for LDAPBundle().")
 714         counter = 0
 715         while counter < len(self.dn_list) and self.two_domains:
 716             # Use alias reference
 717             tmp = self.dn_list[counter]
 718             tmp = tmp[:len(tmp) - len(self.con.base_dn)] + "${DOMAIN_DN}"
 719             tmp = tmp.replace("CN=%s" % self.con.domain_netbios, "CN=${DOMAIN_NETBIOS}")
 720             if len(self.con.server_names) == 1:
 721                 for x in self.con.server_names:
 722                     tmp = tmp.replace("CN=%s" % x, "CN=${SERVER_NAME}")
 723             self.dn_list[counter] = tmp
 724             counter += 1
 725         self.dn_list = list(set(self.dn_list))
 726         self.dn_list = sorted(self.dn_list)
 727         self.size = len(self.dn_list)
 728
 729     def log(self, msg):
 730         """
 731         Log on the screen if there is no --quiet option set
 732         """
 733         if not self.quiet:
 734             self.outf.write(msg + "\n")
 735
 736     def update_size(self):
 737         self.size = len(self.dn_list)
 738         self.dn_list = sorted(self.dn_list)
 739
 740     def diff(self, other):
 741         res = True
 742         if self.size != other.size:
 743             self.log("\n* DN lists have different size: %s != %s" % (self.size, other.size))
 744             if not self.skip_missing_dn:
 745                 res = False
 746
 747         self_dns = set([q.upper() for q in self.dn_list])
 748         other_dns = set([q.upper() for q in other.dn_list])
 749
 750         #
 751         # This is the case where we want to explicitly compare two objects with different DNs.
 752         # It does not matter if they are in the same DC, in two DC in one domain or in two
 753         # different domains.
 754         if self.search_scope != SCOPE_BASE and not self.skip_missing_dn:
 755
 756             self_only = self_dns - other_dns  # missing in other
 757             if self_only:
 758                 res = False
 759                 self.log("\n* DNs found only in %s:" % self.con.host)
 760                 for x in self_only:
 761                     self.log(4 * " " + x)
 762
 763             other_only = other_dns - self_dns  # missing in self
 764             if other_only:
 765                 res = False
 766                 self.log("\n* DNs found only in %s:" % other.con.host)
 767                 for x in other_only:
 768                     self.log(4 * " " + x)
 769
 770         common_dns = self_dns & other_dns
 771         self.log("\n* Objects to be compared: %d" % len(common_dns))
 772
 773         for dn in common_dns:
 774
 775             try:
 776                 object1 = LDAPObject(connection=self.con,
 777                                      dn=dn,
 778                                      summary=self.summary,
 779                                      filter_list=self.filter_list,
 780                                      outf=self.outf, errf=self.errf)
 781             except LdbError as e:
 782                 self.log("LdbError for dn %s: %s" % (dn, e))
 783                 continue
 784
 785             try:
 786                 object2 = LDAPObject(connection=other.con,
 787                                      dn=dn,
 788                                      summary=other.summary,
 789                                      filter_list=self.filter_list,
 790                                      outf=self.outf, errf=self.errf)
 791             except LdbError as e:
 792                 self.log("LdbError for dn %s: %s" % (dn, e))
 793                 continue
 794
 795             if object1 == object2:
 796                 if self.con.verbose:
 797                     self.log("\nComparing:")
 798                     self.log("'%s' [%s]" % (object1.dn, object1.con.host))
 799                     self.log("'%s' [%s]" % (object2.dn, object2.con.host))
 800                     self.log(4 * " " + "OK")
 801             else:
 802                 self.log("\nComparing:")
 803                 self.log("'%s' [%s]" % (object1.dn, object1.con.host))
 804                 self.log("'%s' [%s]" % (object2.dn, object2.con.host))
 805                 self.log(object1.screen_output)
 806                 self.log(4 * " " + "FAILED")
 807                 res = False
 808             self.summary = object1.summary
 809             other.summary = object2.summary
 810
 811         return res
 812
 813     def get_dn_list(self, context):
 814         """ Query LDAP server about the DNs of certain naming self.con.ext Domain (or Default), Configuration, Schema.
 815             Parse all DNs and filter those that are 'strange' or abnormal.
 816         """
 817         if context.upper() == "DOMAIN":
 818             search_base = self.con.base_dn
 819         elif context.upper() == "CONFIGURATION":
 820             search_base = self.con.config_dn
 821         elif context.upper() == "SCHEMA":
 822             search_base = self.con.schema_dn
 823         elif context.upper() == "DNSDOMAIN":
 824             search_base = "DC=DomainDnsZones,%s" % self.con.base_dn
 825         elif context.upper() == "DNSFOREST":
 826             search_base = "DC=ForestDnsZones,%s" % self.con.root_dn
 827
 828         dn_list = []
 829         if not self.search_base:
 830             self.search_base = search_base
 831         self.search_scope = self.search_scope.upper()
 832         if self.search_scope == "SUB":
 833             self.search_scope = SCOPE_SUBTREE
 834         elif self.search_scope == "BASE":
 835             self.search_scope = SCOPE_BASE
 836         elif self.search_scope == "ONE":
 837             self.search_scope = SCOPE_ONELEVEL
 838         else:
 839             raise ValueError("Wrong 'scope' given. Choose from: SUB, ONE, BASE")
 840         try:
 841             res = self.con.ldb.search(base=self.search_base, scope=self.search_scope, attrs=["dn"])
 842         except LdbError as e3:
 843             (enum, estr) = e3.args
 844             self.outf.write("Failed search of base=%s\n" % self.search_base)
 845             raise
 846         for x in res:
 847             dn_list.append(x["dn"].get_linearized())
 848         return dn_list
 849
 850     def print_summary(self):
 851         self.summary["unique_attrs"] = list(set(self.summary["unique_attrs"]))
 852         self.summary["df_value_attrs"] = list(set(self.summary["df_value_attrs"]))
 853         #
 854         if self.summary["unique_attrs"]:
 855             self.log("\nAttributes found only in %s:" % self.con.host)
 856             self.log("".join([str("\n" + 4 * " " + x) for x in self.summary["unique_attrs"]]))
 857         #
 858         if self.summary["df_value_attrs"]:
 859             self.log("\nAttributes with different values:")
 860             self.log("".join([str("\n" + 4 * " " + x) for x in self.summary["df_value_attrs"]]))
 861             self.summary["df_value_attrs"] = []
 862
 863
 864 class cmd_ldapcmp(Command):
 865     """Compare two ldap databases."""
 866     synopsis = "%prog <URL1> <URL2> (domain|configuration|schema|dnsdomain|dnsforest) [options]"
 867
 868     takes_optiongroups = {
 869         "sambaopts": options.SambaOptions,
 870         "versionopts": options.VersionOptions,
 871         "credopts": options.CredentialsOptionsDouble,
 872     }
 873
 874     takes_args = ["URL1", "URL2", "context1?", "context2?", "context3?", "context4?", "context5?"]
 875
 876     takes_options = [
 877         Option("-w", "--two", dest="two", action="store_true", default=False,
 878                help="Hosts are in two different domains"),
 879         Option("-q", "--quiet", dest="quiet", action="store_true", default=False,
 880                help="Do not print anything but relay on just exit code"),
 881         Option("-v", "--verbose", dest="verbose", action="store_true", default=False,
 882                help="Print all DN pairs that have been compared"),
 883         Option("--sd", dest="descriptor", action="store_true", default=False,
 884                help="Compare nTSecurityDescriptor attibutes only"),
 885         Option("--sort-aces", dest="sort_aces", action="store_true", default=False,
 886                help="Sort ACEs before comparison of nTSecurityDescriptor attribute"),
 887         Option("--view", dest="view", default="section", choices=["section", "collision"],
 888                help="Display mode for nTSecurityDescriptor results. Possible values: section or collision."),
 889         Option("--base", dest="base", default="",
 890                help="Pass search base that will build DN list for the first DC."),
 891         Option("--base2", dest="base2", default="",
 892                help="Pass search base that will build DN list for the second DC. Used when --two or when compare two different DNs."),
 893         Option("--scope", dest="scope", default="SUB", choices=["SUB", "ONE", "BASE"],
 894                help="Pass search scope that builds DN list. Options: SUB, ONE, BASE"),
 895         Option("--filter", dest="filter", default="",
 896                help="List of comma separated attributes to ignore in the comparision"),
 897         Option("--skip-missing-dn", dest="skip_missing_dn", action="store_true", default=False,
 898                help="Skip report and failure due to missing DNs in one server or another"),
 899     ]
 900
 901     def run(self, URL1, URL2,
 902             context1=None, context2=None, context3=None, context4=None, context5=None,
 903             two=False, quiet=False, verbose=False, descriptor=False, sort_aces=False,
 904             view="section", base="", base2="", scope="SUB", filter="",
 905             credopts=None, sambaopts=None, versionopts=None, skip_missing_dn=False):
 906
 907         lp = sambaopts.get_loadparm()
 908
 909         using_ldap = URL1.startswith("ldap") or URL2.startswith("ldap")
 910
 911         if using_ldap:
 912             creds = credopts.get_credentials(lp, fallback_machine=True)
 913         else:
 914             creds = None
 915         creds2 = credopts.get_credentials2(lp, guess=False)
 916         if creds2.is_anonymous():
 917             creds2 = creds
 918         else:
 919             creds2.set_domain("")
 920             creds2.set_workstation("")
 921         if using_ldap and not creds.authentication_requested():
 922             raise CommandError("You must supply at least one username/password pair")
 923
 924         # make a list of contexts to compare in
 925         contexts = []
 926         if context1 is None:
 927             if base and base2:
 928                 # If search bases are specified context is defaulted to
 929                 # DOMAIN so the given search bases can be verified.
 930                 contexts = ["DOMAIN"]
 931             else:
 932                 # if no argument given, we compare all contexts
 933                 contexts = ["DOMAIN", "CONFIGURATION", "SCHEMA", "DNSDOMAIN", "DNSFOREST"]
 934         else:
 935             for c in [context1, context2, context3, context4, context5]:
 936                 if c is None:
 937                     continue
 938                 if not c.upper() in ["DOMAIN", "CONFIGURATION", "SCHEMA", "DNSDOMAIN", "DNSFOREST"]:
 939                     raise CommandError("Incorrect argument: %s" % c)
 940                 contexts.append(c.upper())
 941
 942         if verbose and quiet:
 943             raise CommandError("You cannot set --verbose and --quiet together")
 944         if (not base and base2) or (base and not base2):
 945             raise CommandError("You need to specify both --base and --base2 at the same time")
 946
 947         con1 = LDAPBase(URL1, creds, lp,
 948                         two=two, quiet=quiet, descriptor=descriptor, sort_aces=sort_aces,
 949                         verbose=verbose, view=view, base=base, scope=scope,
 950                         outf=self.outf, errf=self.errf)
 951         assert len(con1.base_dn) > 0
 952
 953         con2 = LDAPBase(URL2, creds2, lp,
 954                         two=two, quiet=quiet, descriptor=descriptor, sort_aces=sort_aces,
 955                         verbose=verbose, view=view, base=base2, scope=scope,
 956                         outf=self.outf, errf=self.errf)
 957         assert len(con2.base_dn) > 0
 958
 959         filter_list = filter.split(",")
 960
 961         status = 0
 962         for context in contexts:
 963             if not quiet:
 964                 self.outf.write("\n* Comparing [%s] context...\n" % context)
 965
 966             b1 = LDAPBundle(con1, context=context, filter_list=filter_list,
 967                             outf=self.outf, errf=self.errf)
 968             b2 = LDAPBundle(con2, context=context, filter_list=filter_list,
 969                             outf=self.outf, errf=self.errf)
 970
 971             if b1.diff(b2):
 972                 if not quiet:
 973                     self.outf.write("\n* Result for [%s]: SUCCESS\n" %
 974                                     context)
 975             else:
 976                 if not quiet:
 977                     self.outf.write("\n* Result for [%s]: FAILURE\n" % context)
 978                     if not descriptor:
 979                         assert len(b1.summary["df_value_attrs"]) == len(b2.summary["df_value_attrs"])
 980                         b2.summary["df_value_attrs"] = []
 981                         self.outf.write("\nSUMMARY\n")
 982                         self.outf.write("---------\n")
 983                         b1.print_summary()
 984                         b2.print_summary()
 985                 # mark exit status as FAILURE if a least one comparison failed
 986                 status = -1
 987         if status != 0:
 988             raise CommandError("Compare failed: %d" % status)