#!/usr/bin/python # # Copyright (C) Matthieu Patou 2009 # # Based on provision a Samba4 server by # Copyright (C) Jelmer Vernooij 2007-2008 # Copyright (C) Andrew Bartlett 2008 # # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . import getopt import shutil import optparse import os import sys import random import string import re import base64 import tempfile # Find right directory when running from source tree sys.path.insert(0, "bin/python") from base64 import b64encode import samba from samba.credentials import DONT_USE_KERBEROS from samba.auth import system_session, admin_session from samba import Ldb, DS_DOMAIN_FUNCTION_2000, DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008, DS_DC_FUNCTION_2008_R2 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError import ldb import samba.getopt as options from samba.samdb import SamDB from samba import param from samba import glue from samba.misc import messageEltFlagToString from samba.provision import ProvisionNames,provision_paths_from_lp,find_setup_dir,FILL_FULL,provision, get_domain_descriptor, get_config_descriptor, secretsdb_self_join from samba.provisionexceptions import ProvisioningError from samba.schema import get_dnsyntax_attributes, get_linked_attributes, Schema, get_schema_descriptor from samba.dcerpc import misc, security from samba.ndr import ndr_pack, ndr_unpack from samba.dcerpc.misc import SEC_CHAN_BDC never=0 replace=2^ldb.FLAG_MOD_REPLACE add=2^ldb.FLAG_MOD_ADD delete=2^ldb.FLAG_MOD_DELETE #Errors are always logged ERROR = -1 SIMPLE = 0x00 CHANGE = 0x01 CHANGESD = 0x02 GUESS = 0x04 PROVISION = 0x08 CHANGEALL = 0xff # Attributes that are never copied from the reference provision (even if they # do not exist in the destination object). # This is most probably because they are populated automatcally when object is # created # This also apply to imported object from reference provision hashAttrNotCopied = { "dn": 1,"whenCreated": 1,"whenChanged": 1,"objectGUID": 1,"replPropertyMetaData": 1,"uSNChanged": 1, "uSNCreated": 1,"parentGUID": 1,"objectCategory": 1,"distinguishedName": 1, "showInAdvancedViewOnly": 1,"instanceType": 1, "cn": 1, "msDS-Behavior-Version":1, "nextRid":1, "nTMixedDomain": 1,"versionNumber":1, "lmPwdHistory":1, "pwdLastSet": 1, "ntPwdHistory":1, "unicodePwd":1, "dBCSPwd":1,"supplementalCredentials":1,"gPCUserExtensionNames":1, "gPCMachineExtensionNames":1, "maxPwdAge":1, "mail":1, "secret":1,"possibleInferiors":1, "sAMAccountType":1} # Usually for an object that already exists we do not overwrite attributes as # they might have been changed for good reasons. Anyway for a few of them it's # mandatory to replace them otherwise the provision will be broken somehow. hashOverwrittenAtt = { "prefixMap": replace, "systemMayContain": replace,"systemOnly":replace, "searchFlags":replace, "mayContain":replace, "systemFlags":replace,"description":replace, "oEMInformation":replace, "operatingSystemVersion":replace, "adminPropertyPages":replace, "defaultSecurityDescriptor": replace,"wellKnownObjects":replace,"privilege":delete,"groupType":replace, "rIDAvailablePool": never} backlinked = [] dn_syntax_att = [] def define_what_to_log(opts): what = 0 if opts.debugchange: what = what | CHANGE if opts.debugchangesd: what = what | CHANGESD if opts.debugguess: what = what | GUESS if opts.debugprovision: what = what | PROVISION if opts.debugall: what = what | CHANGEALL return what parser = optparse.OptionParser("provision [options]") sambaopts = options.SambaOptions(parser) parser.add_option_group(sambaopts) parser.add_option_group(options.VersionOptions(parser)) credopts = options.CredentialsOptions(parser) parser.add_option_group(credopts) parser.add_option("--setupdir", type="string", metavar="DIR", help="directory with setup files") parser.add_option("--debugprovision", help="Debug provision", action="store_true") parser.add_option("--debugguess", help="Print information on what is different but won't be changed", action="store_true") parser.add_option("--debugchange", help="Print information on what is different but won't be changed", action="store_true") parser.add_option("--debugchangesd", help="Print information security descriptors differences", action="store_true") parser.add_option("--debugall", help="Print all available information (very verbose)", action="store_true") parser.add_option("--full", help="Perform full upgrade of the samdb (schema, configuration, new objects, ...", action="store_true") opts = parser.parse_args()[0] whatToLog = define_what_to_log(opts) def messageprovision(text): """print a message if quiet is not set.""" if opts.debugprovision or opts.debugall: print text def message(what,text): """print a message if quiet is not set.""" if (whatToLog & what) or (what <= 0 ): print text if len(sys.argv) == 1: opts.interactive = True lp = sambaopts.get_loadparm() smbconf = lp.configfile creds = credopts.get_credentials(lp) creds.set_kerberos_state(DONT_USE_KERBEROS) setup_dir = opts.setupdir if setup_dir is None: setup_dir = find_setup_dir() session = system_session() # simple helper to allow back and forth rename def identic_rename(ldbobj,dn): (before,sep,after)=str(dn).partition('=') ldbobj.rename(dn,ldb.Dn(ldbobj,"%s=foo%s"%(before,after))) ldbobj.rename(ldb.Dn(ldbobj,"%s=foo%s"%(before,after)),dn) # Create an array of backlinked attributes def populate_backlink(newpaths,creds,session,schemadn): newsam_ldb = Ldb(newpaths.samdb, session_info=session, credentials=creds,lp=lp) linkedAttHash = get_linked_attributes(ldb.Dn(newsam_ldb,str(schemadn)),newsam_ldb) backlinked.extend(linkedAttHash.values()) # Create an array of attributes with a dn synthax (2.5.5.1) def populate_dnsyntax(newpaths,creds,session,schemadn): newsam_ldb = Ldb(newpaths.samdb, session_info=session, credentials=creds,lp=lp) res = newsam_ldb.search(expression="(attributeSyntax=2.5.5.1)",base=ldb.Dn(newsam_ldb,str(schemadn)), scope=SCOPE_SUBTREE, attrs=["lDAPDisplayName"]) for elem in res: dn_syntax_att.append(elem["lDAPDisplayName"]) # Get Paths for important objects (ldb, keytabs ...) def get_paths(targetdir=None,smbconf=None): if targetdir is not None: if (not os.path.exists(os.path.join(targetdir, "etc"))): os.makedirs(os.path.join(targetdir, "etc")) smbconf = os.path.join(targetdir, "etc", "smb.conf") if smbconf is None: smbconf = param.default_path() if not os.path.exists(smbconf): message(ERROR,"Unable to find smb.conf ..") parser.print_usage() sys.exit(1) lp = param.LoadParm() lp.load(smbconf) # Normally we need the domain name for this function but for our needs it's # pointless paths = provision_paths_from_lp(lp,"foo") return paths def sanitychecks(credentials,session_info,names,paths): sam_ldb = Ldb(paths.samdb, session_info=session, credentials=creds,lp=lp,options=["modules:samba_dsdb"]) # First update the SD for the rootdn sam_ldb.set_session_info(session) res = sam_ldb.search(expression="objectClass=ntdsdsa",base=str(names.configdn), scope=SCOPE_SUBTREE,attrs=["dn"],controls=["search_options:1:2"]) if len(res) == 0: print "No DC found, your provision is most probalby hardly broken !" return 0 elif len(res) != 1: print "Found %d domain controllers, for the moment upgradeprovision is not able to handle upgrade on \ domain with more than one DC, please demote the other DC before upgrading"%len(res) return 0 else: return 1 # This function guesses (fetches) informations needed to make a fresh provision # from the current provision # It includes: realm, workgroup, partitions, netbiosname, domain guid, ... def guess_names_from_current_provision(credentials,session_info,paths): lp = param.LoadParm() lp.load(paths.smbconf) names = ProvisionNames() # NT domain, kerberos realm, root dn, domain dn, domain dns name names.domain = string.upper(lp.get("workgroup")) names.realm = lp.get("realm") basedn = "DC=" + names.realm.replace(".",",DC=") names.dnsdomain = names.realm names.realm = string.upper(names.realm) # netbiosname secrets_ldb = Ldb(paths.secrets, session_info=session_info, credentials=credentials,lp=lp, options=["modules:samba_secrets"]) # Get the netbiosname first (could be obtained from smb.conf in theory) attrs = ["sAMAccountName"] res = secrets_ldb.search(expression="(flatname=%s)"%names.domain,base="CN=Primary Domains", scope=SCOPE_SUBTREE, attrs=attrs) names.netbiosname = str(res[0]["sAMAccountName"]).replace("$","") names.smbconf = smbconf # It's important here to let ldb load with the old module or it's quite # certain that the LDB won't load ... samdb = Ldb(paths.samdb, session_info=session_info, credentials=credentials, lp=lp, options=["modules:samba_dsdb"]) # That's a bit simplistic but it's ok as long as we have only 3 # partitions attrs2 = ["defaultNamingContext", "schemaNamingContext","configurationNamingContext","rootDomainNamingContext"] current = samdb.search(expression="(objectClass=*)",base="", scope=SCOPE_BASE, attrs=attrs2) names.configdn = current[0]["configurationNamingContext"] configdn = str(names.configdn) names.schemadn = current[0]["schemaNamingContext"] if not (ldb.Dn(samdb, basedn) == (ldb.Dn(samdb, current[0]["defaultNamingContext"][0]))): raise ProvisioningError(("basedn in %s (%s) and from %s (%s) is not the same ..." % (paths.samdb, str(current[0]["defaultNamingContext"][0]), paths.smbconf, basedn))) names.domaindn=current[0]["defaultNamingContext"] names.rootdn=current[0]["rootDomainNamingContext"] # default site name attrs3 = ["cn"] res3= samdb.search(expression="(objectClass=*)",base="CN=Sites,"+configdn, scope=SCOPE_ONELEVEL, attrs=attrs3) names.sitename = str(res3[0]["cn"]) # dns hostname and server dn attrs4 = ["dNSHostName"] res4= samdb.search(expression="(CN=%s)"%names.netbiosname,base="OU=Domain Controllers,"+basedn, \ scope=SCOPE_ONELEVEL, attrs=attrs4) names.hostname = str(res4[0]["dNSHostName"]).replace("."+names.dnsdomain,"") server_res = samdb.search(expression="serverReference=%s"%res4[0].dn, attrs=[], base=configdn) names.serverdn = server_res[0].dn # invocation id/objectguid res5 = samdb.search(expression="(objectClass=*)",base="CN=NTDS Settings,%s" % str(names.serverdn), scope=SCOPE_BASE, attrs=["invocationID","objectGUID"]) names.invocation = str(ndr_unpack( misc.GUID,res5[0]["invocationId"][0])) names.ntdsguid = str(ndr_unpack( misc.GUID,res5[0]["objectGUID"][0])) # domain guid/sid attrs6 = ["objectGUID", "objectSid","msDS-Behavior-Version" ] res6 = samdb.search(expression="(objectClass=*)",base=basedn, scope=SCOPE_BASE, attrs=attrs6) names.domainguid = str(ndr_unpack( misc.GUID,res6[0]["objectGUID"][0])) names.domainsid = ndr_unpack( security.dom_sid,res6[0]["objectSid"][0]) if res6[0].get("msDS-Behavior-Version") == None or int(res6[0]["msDS-Behavior-Version"][0]) < DS_DOMAIN_FUNCTION_2000: names.domainlevel = DS_DOMAIN_FUNCTION_2000 else: names.domainlevel = int(res6[0]["msDS-Behavior-Version"][0]) # policy guid attrs7 = ["cn","displayName"] res7 = samdb.search(expression="(displayName=Default Domain Policy)",base="CN=Policies,CN=System,"+basedn, \ scope=SCOPE_ONELEVEL, attrs=attrs7) names.policyid = str(res7[0]["cn"]).replace("{","").replace("}","") # dc policy guid attrs8 = ["cn","displayName"] res8 = samdb.search(expression="(displayName=Default Domain Controllers Policy)",base="CN=Policies,CN=System,"+basedn, \ scope=SCOPE_ONELEVEL, attrs=attrs7) if len(res8) == 1: names.policyid_dc = str(res8[0]["cn"]).replace("{","").replace("}","") else: names.policyid_dc = None return names # Debug a little bit def print_names(names): message(GUESS, "rootdn :"+str(names.rootdn)) message(GUESS, "configdn :"+str(names.configdn)) message(GUESS, "schemadn :"+str(names.schemadn)) message(GUESS, "serverdn :"+str(names.serverdn)) message(GUESS, "netbiosname :"+names.netbiosname) message(GUESS, "defaultsite :"+names.sitename) message(GUESS, "dnsdomain :"+names.dnsdomain) message(GUESS, "hostname :"+names.hostname) message(GUESS, "domain :"+names.domain) message(GUESS, "realm :"+names.realm) message(GUESS, "invocationid:"+names.invocation) message(GUESS, "policyguid :"+names.policyid) message(GUESS, "policyguiddc:"+str(names.policyid_dc)) message(GUESS, "domainsid :"+str(names.domainsid)) message(GUESS, "domainguid :"+names.domainguid) message(GUESS, "ntdsguid :"+names.ntdsguid) message(GUESS, "domainlevel :"+str(names.domainlevel)) # Create a fresh new reference provision # This provision will be the reference for knowing what has changed in the # since the latest upgrade in the current provision def newprovision(names,setup_dir,creds,session,smbconf): message(SIMPLE, "Creating a reference provision") provdir=tempfile.mkdtemp(dir=paths.private_dir, prefix="referenceprovision") if os.path.isdir(provdir): rmall(provdir) logstd=os.path.join(provdir,"log.std") os.chdir(os.path.join(setup_dir,"..")) os.mkdir(provdir) os.close(2) sys.stderr = open("%s/provision.log"%provdir, "w") message(PROVISION, "Reference provision stored in %s"%provdir) message(PROVISION, "STDERR message of provision will be logged in %s/provision.log"%provdir) sys.stderr = open("/dev/stdout", "w") provision(setup_dir, messageprovision, session, creds, smbconf=smbconf, targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm, domain=names.domain, domainguid=names.domainguid, domainsid=str(names.domainsid),ntdsguid=names.ntdsguid, policyguid=names.policyid,policyguid_dc=names.policyid_dc,hostname=names.netbiosname, hostip=None, hostip6=None, invocationid=names.invocation, adminpass=None, krbtgtpass=None, machinepass=None, dnspass=None, root=None, nobody=None, wheel=None, users=None, serverrole="domain controller", ldap_backend_extra_port=None, backend_type=None, ldapadminpass=None, ol_mmr_urls=None, slapd_path=None, setup_ds_path=None, nosync=None, dom_for_fun_level=names.domainlevel, ldap_dryrun_mode=None,useeadb=True) return provdir # This function sorts two DNs in the lexicographical order and put higher level # DN before. # So given the dns cn=bar,cn=foo and cn=foo the later will be return as smaller # (-1) as it has less level def dn_sort(x,y): p = re.compile(r'(? len(tab2)): min = len(tab2) elif (len(tab1) < len(tab2)): min = len(tab1) else: min = len(tab1) len1=len(tab1)-1 len2=len(tab2)-1 space = " " # Note: python range go up to upper limit but do not include it for i in range(0,min): ret=cmp(tab1[len1-i],tab2[len2-i]) if(ret != 0): return ret else: if(i==min-1): if(len1==len2): message(ERROR,"PB PB PB"+space.join(tab1)+" / "+space.join(tab2)) if(len1>len2): return 1 else: return -1 return ret # Check for security descriptors modifications return 1 if it is and 0 otherwise # it also populate hash structure for later use in the upgrade process def handle_security_desc(ischema,att,msgElt,hashallSD,old,new): if ischema == 1 and att == "defaultSecurityDescriptor" and msgElt.flags() == ldb.FLAG_MOD_REPLACE: hashSD = {} hashSD["oldSD"] = old[0][att] hashSD["newSD"] = new[0][att] hashallSD[str(old[0].dn)] = hashSD return 0 if att == "nTSecurityDescriptor" and msgElt.flags() == ldb.FLAG_MOD_REPLACE: if ischema == 0: hashSD = {} hashSD["oldSD"] = ndr_unpack(security.descriptor,str(old[0][att])) hashSD["newSD"] = ndr_unpack(security.descriptor,str(new[0][att])) hashallSD[str(old[0].dn)] = hashSD return 1 return 0 # Handle special cases ... That's when we want to update a particular attribute # only, e.g. if it has a certain value or if it's for a certain object or # a class of object. # It can be also if we want to do a merge of value instead of a simple replace def handle_special_case(att,delta,new,old,ischema): flag = delta.get(att).flags() if (att == "gPLink" or att == "gPCFileSysPath") and flag == ldb.FLAG_MOD_REPLACE and str(new[0].dn).lower() == str(old[0].dn).lower(): delta.remove(att) return 1 if att == "forceLogoff": ref=0x8000000000000000 oldval=int(old[0][att][0]) newval=int(new[0][att][0]) ref == old and ref == abs(new) return 1 if (att == "adminDisplayName" or att == "adminDescription") and ischema: return 1 if (str(old[0].dn) == "CN=Samba4-Local-Domain,%s"%(str(names.schemadn)) and att == "defaultObjectCategory" and flag == ldb.FLAG_MOD_REPLACE): return 1 # if (str(old[0].dn) == "CN=S-1-5-11,CN=ForeignSecurityPrincipals,%s"%(str(names.rootdn)) and att == "description" and flag == ldb.FLAG_MOD_DELETE): # return 1 if (str(old[0].dn) == "CN=Title,%s"%(str(names.schemadn)) and att == "rangeUpper" and flag == ldb.FLAG_MOD_REPLACE): return 1 if ( (att == "member" or att == "servicePrincipalName") and flag == ldb.FLAG_MOD_REPLACE): hash = {} newval = [] changeDelta=0 for elem in old[0][att]: hash[str(elem)]=1 newval.append(str(elem)) for elem in new[0][att]: if not hash.has_key(str(elem)): changeDelta=1 newval.append(str(elem)) if changeDelta == 1: delta[att] = ldb.MessageElement(newval, ldb.FLAG_MOD_REPLACE, att) else: delta.remove(att) return 1 if (str(old[0].dn) == "%s"%(str(names.rootdn)) and att == "subRefs" and flag == ldb.FLAG_MOD_REPLACE): return 1 if str(delta.dn).endswith("CN=DisplaySpecifiers,%s"%names.configdn): return 1 return 0 def update_secrets(newpaths,paths,creds,session): message(SIMPLE,"update secrets.ldb") newsecrets_ldb = Ldb(newpaths.secrets, session_info=session, credentials=creds,lp=lp) secrets_ldb = Ldb(paths.secrets, session_info=session, credentials=creds,lp=lp, options=["modules:samba_secrets"]) reference = newsecrets_ldb.search(expression="dn=@MODULES",base="", scope=SCOPE_SUBTREE) current = secrets_ldb.search(expression="dn=@MODULES",base="", scope=SCOPE_SUBTREE) delta = secrets_ldb.msg_diff(current[0],reference[0]) delta.dn = current[0].dn secrets_ldb.modify(delta) newsecrets_ldb = Ldb(newpaths.secrets, session_info=session, credentials=creds,lp=lp) secrets_ldb = Ldb(paths.secrets, session_info=session, credentials=creds,lp=lp) reference = newsecrets_ldb.search(expression="objectClass=top",base="", scope=SCOPE_SUBTREE,attrs=["dn"]) current = secrets_ldb.search(expression="objectClass=top",base="", scope=SCOPE_SUBTREE,attrs=["dn"]) hash_new = {} hash = {} listMissing = [] listPresent = [] empty = ldb.Message() for i in range(0,len(reference)): hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"] # Create a hash for speeding the search of existing object in the # current provision for i in range(0,len(current)): hash[str(current[i]["dn"]).lower()] = current[i]["dn"] for k in hash_new.keys(): if not hash.has_key(k): listMissing.append(hash_new[k]) else: listPresent.append(hash_new[k]) for entry in listMissing: reference = newsecrets_ldb.search(expression="dn=%s"%entry,base="", scope=SCOPE_SUBTREE) current = secrets_ldb.search(expression="dn=%s"%entry,base="", scope=SCOPE_SUBTREE) delta = secrets_ldb.msg_diff(empty,reference[0]) for att in hashAttrNotCopied.keys(): delta.remove(att) message(CHANGE,"Entry %s is missing from secrets.ldb"%reference[0].dn) for att in delta: message(CHANGE," Adding attribute %s"%att) delta.dn = reference[0].dn secrets_ldb.add(delta) for entry in listPresent: reference = newsecrets_ldb.search(expression="dn=%s"%entry,base="", scope=SCOPE_SUBTREE) current = secrets_ldb.search(expression="dn=%s"%entry,base="", scope=SCOPE_SUBTREE) delta = secrets_ldb.msg_diff(current[0],reference[0]) i=0 for att in hashAttrNotCopied.keys(): delta.remove(att) for att in delta: i = i + 1 if att == "name": message(CHANGE,"Found attribute name on %s, must rename the DN "%(current[0].dn)) identic_rename(secrets_ldb,reference[0].dn) else: delta.remove(att) for entry in listPresent: reference = newsecrets_ldb.search(expression="dn=%s"%entry,base="", scope=SCOPE_SUBTREE) current = secrets_ldb.search(expression="dn=%s"%entry,base="", scope=SCOPE_SUBTREE) delta = secrets_ldb.msg_diff(current[0],reference[0]) i=0 for att in hashAttrNotCopied.keys(): delta.remove(att) for att in delta: i = i + 1 if att != "dn": message(CHANGE," Adding/Changing attribute %s to %s"%(att,current[0].dn)) delta.dn = current[0].dn secrets_ldb.modify(delta) def dump_denied_change(dn,att,flagtxt,current,reference): message(CHANGE, "dn= "+str(dn)+" "+att+" with flag "+flagtxt+" is not allowed to be changed/removed, I discard this change ...") if att != "objectSid" : i = 0 for e in range(0,len(current)): message(CHANGE,"old %d : %s"%(i,str(current[e]))) i=i+1 if reference != None: i = 0 for e in range(0,len(reference)): message(CHANGE,"new %d : %s"%(i,str(reference[e]))) i=i+1 else: message(CHANGE,"old : %s"%str(ndr_unpack( security.dom_sid,current[0]))) message(CHANGE,"new : %s"%str(ndr_unpack( security.dom_sid,reference[0]))) #This function is for doing case by case treatment on special object def handle_special_add(sam_ldb,dn,names): dntoremove=None if str(dn).lower() == ("CN=Certificate Service DCOM Access,CN=Builtin,%s"%names.rootdn).lower(): #This entry was misplaced lets remove it if it exists dntoremove="CN=Certificate Service DCOM Access,CN=Users,%s"%names.rootdn if str(dn).lower() == ("CN=Cryptographic Operators,CN=Builtin,%s"%names.rootdn).lower(): #This entry was misplaced lets remove it if it exists dntoremove="CN=Cryptographic Operators,CN=Users,%s"%names.rootdn if str(dn).lower() == ("CN=Event Log Readers,CN=Builtin,%s"%names.rootdn).lower(): #This entry was misplaced lets remove it if it exists dntoremove="CN=Event Log Readers,CN=Users,%s"%names.rootdn if dntoremove != None: res = sam_ldb.search(expression="objectClass=*",base=dntoremove, scope=SCOPE_BASE,attrs=["dn"],controls=["search_options:1:2"]) if len(res) > 0: message(CHANGE,"Existing object %s must be replaced by %s, removing old object"%(dntoremove,str(dn))) sam_ldb.delete(res[0]["dn"]) #Check if the one of the dn in the listdn will be created after the current dn #hash is indexed by dn to be created, with each key is associated the creation order #First dn to be created has the creation order 0, second has 1, ... #Index contain the current creation order def check_dn_nottobecreated(hash,index,listdn): if listdn == None: return None for dn in listdn: key = str(dn).lower() if hash.has_key(key) and hash[key] > index: return str(dn) return None #This function tries to add the missing object "dn" if this object depends on some others # the function returns 0, if the object was created 1 is returned def add_missing_object(newsam_ldb,sam_ldb,dn,names,basedn,hash,index): handle_special_add(sam_ldb,dn,names) reference = newsam_ldb.search(expression="dn=%s"%(str(dn)),base=basedn, scope=SCOPE_SUBTREE,controls=["search_options:1:2"]) empty = ldb.Message() delta = sam_ldb.msg_diff(empty,reference[0]) for att in hashAttrNotCopied.keys(): delta.remove(att) for att in backlinked: delta.remove(att) depend_on_yettobecreated = None for att in dn_syntax_att: depend_on_yet_tobecreated = check_dn_nottobecreated(hash,index,delta.get(str(att))) if depend_on_yet_tobecreated != None: message(CHANGE,"Object %s depends on %s in attribute %s, delaying the creation" %(str(dn),depend_on_yet_tobecreated,str(att))) return 0 delta.dn = dn message(CHANGE,"Object %s will be added"%dn) sam_ldb.add(delta,["relax:0"]) return 1 def gen_dn_index_hash(listMissing): hash = {} for i in range(0,len(listMissing)): hash[str(listMissing[i]).lower()] = i return hash def add_missing_entries(newsam_ldb,sam_ldb,names,basedn,list): listMissing = [] listDefered = list while(len(listDefered) != len(listMissing) and len(listDefered) > 0): index = 0 listMissing = listDefered listDefered = [] hashMissing = gen_dn_index_hash(listMissing) for dn in listMissing: ret = add_missing_object(newsam_ldb,sam_ldb,dn,names,basedn,hashMissing,index) index = index + 1 if ret == 0: #DN can't be created because it depends on some other DN in the list listDefered.append(dn) if len(listDefered) != 0: raise ProvisioningError("Unable to insert missing elements: circular references") # Check difference between the current provision and the reference provision. # It looks for all objects which base DN is name. If ischema is "false" then # the scan is done in cross partition mode. # If "ischema" is true, then special handling is done for dealing with schema def check_diff_name(newpaths,paths,creds,session,basedn,names,ischema): hash_new = {} hash = {} hashallSD = {} listMissing = [] listPresent = [] reference = [] current = [] # Connect to the reference provision and get all the attribute in the # partition referred by name newsam_ldb = Ldb(newpaths.samdb, session_info=session, credentials=creds,lp=lp) sam_ldb = Ldb(paths.samdb, session_info=session, credentials=creds,lp=lp, options=["modules:samba_dsdb"]) sam_ldb.transaction_start() if ischema: reference = newsam_ldb.search(expression="objectClass=*",base=basedn, scope=SCOPE_SUBTREE,attrs=["dn"]) current = sam_ldb.search(expression="objectClass=*",base=basedn, scope=SCOPE_SUBTREE,attrs=["dn"]) else: reference = newsam_ldb.search(expression="objectClass=*",base=basedn, scope=SCOPE_SUBTREE,attrs=["dn"],controls=["search_options:1:2"]) current = sam_ldb.search(expression="objectClass=*",base=basedn, scope=SCOPE_SUBTREE,attrs=["dn"],controls=["search_options:1:2"]) sam_ldb.transaction_commit() # Create a hash for speeding the search of new object for i in range(0,len(reference)): hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"] # Create a hash for speeding the search of existing object in the # current provision for i in range(0,len(current)): hash[str(current[i]["dn"]).lower()] = current[i]["dn"] for k in hash_new.keys(): if not hash.has_key(k): print hash_new[k] listMissing.append(hash_new[k]) else: listPresent.append(hash_new[k]) # Sort the missing object in order to have object of the lowest level # first (which can be containers for higher level objects) listMissing.sort(dn_sort) listPresent.sort(dn_sort) if ischema: # The following lines (up to the for loop) is to load the up to # date schema into our current LDB # a complete schema is needed as the insertion of attributes # and class is done against it # and the schema is self validated # The double ldb open and schema validation is taken from the # initial provision script # it's not certain that it is really needed .... sam_ldb = Ldb(session_info=session, credentials=creds, lp=lp) schema = Schema(setup_path, names.domainsid, schemadn=basedn, serverdn=str(names.serverdn)) # Load the schema from the one we computed earlier sam_ldb.set_schema_from_ldb(schema.ldb) # And now we can connect to the DB - the schema won't be loaded # from the DB sam_ldb.connect(paths.samdb) else: sam_ldb = Ldb(paths.samdb, session_info=session, credentials=creds,lp=lp, options=["modules:samba_dsdb"]) sam_ldb.transaction_start() message(SIMPLE,"There are %d missing objects"%(len(listMissing))) add_missing_entries(newsam_ldb,sam_ldb,names,basedn,listMissing) changed = 0 for dn in listPresent: reference = newsam_ldb.search(expression="dn=%s"%(str(dn)),base=basedn, scope=SCOPE_SUBTREE,controls=["search_options:1:2"]) current = sam_ldb.search(expression="dn=%s"%(str(dn)),base=basedn, scope=SCOPE_SUBTREE,controls=["search_options:1:2"]) if ((str(current[0].dn) != str(reference[0].dn)) and (str(current[0].dn).upper() == str(reference[0].dn).upper())): message(CHANGE,"Name are the same but case change, let's rename %s to %s"%(str(current[0].dn),str(reference[0].dn))) identic_rename(sam_ldb,reference[0].dn) current = sam_ldb.search(expression="dn=%s"%(str(dn)),base=basedn, scope=SCOPE_SUBTREE,controls=["search_options:1:2"]) delta = sam_ldb.msg_diff(current[0],reference[0]) for att in hashAttrNotCopied.keys(): delta.remove(att) for att in backlinked: delta.remove(att) delta.remove("parentGUID") nb = 0 for att in delta: msgElt = delta.get(att) if att == "dn": continue if att == "name": delta.remove(att) continue if handle_security_desc(ischema,att,msgElt,hashallSD,current,reference): delta.remove(att) continue if (not hashOverwrittenAtt.has_key(att) or not (hashOverwrittenAtt.get(att)&2^msgElt.flags())): if hashOverwrittenAtt.has_key(att) and hashOverwrittenAtt.get(att)==never: delta.remove(att) continue if handle_special_case(att,delta,reference,current,ischema)==0 and msgElt.flags()!=ldb.FLAG_MOD_ADD: i = 0 if opts.debugchange or opts.debugall: try: dump_denied_change(dn,att,messageEltFlagToString(msgElt.flags()),current[0][att],reference[0][att]) except: dump_denied_change(dn,att,messageEltFlagToString(msgElt.flags()),current[0][att],None) delta.remove(att) delta.dn = dn if len(delta.items()) >1: attributes=",".join(delta.keys()) message(CHANGE,"%s is different from the reference one, changed attributes: %s"%(dn,attributes)) changed = changed + 1 sam_ldb.modify(delta) sam_ldb.transaction_commit() message(SIMPLE,"There are %d changed objects"%(changed)) return hashallSD # Check that SD are correct def check_updated_sd(newpaths,paths,creds,session,names): newsam_ldb = Ldb(newpaths.samdb, session_info=session, credentials=creds,lp=lp) sam_ldb = Ldb(paths.samdb, session_info=session, credentials=creds,lp=lp) reference = newsam_ldb.search(expression="objectClass=*",base=str(names.rootdn), scope=SCOPE_SUBTREE,attrs=["dn","nTSecurityDescriptor"],controls=["search_options:1:2"]) current = sam_ldb.search(expression="objectClass=*",base=str(names.rootdn), scope=SCOPE_SUBTREE,attrs=["dn","nTSecurityDescriptor"],controls=["search_options:1:2"]) hash_new = {} for i in range(0,len(reference)): hash_new[str(reference[i]["dn"]).lower()] = ndr_unpack(security.descriptor,str(reference[i]["nTSecurityDescriptor"])).as_sddl(names.domainsid) for i in range(0,len(current)): key = str(current[i]["dn"]).lower() if hash_new.has_key(key): sddl = ndr_unpack(security.descriptor,str(current[i]["nTSecurityDescriptor"])).as_sddl(names.domainsid) if sddl != hash_new[key]: print "%s new sddl/sddl in ref"%key print "%s\n%s"%(sddl,hash_new[key]) # Simple update method for updating the SD that rely on the fact that nobody # should have modified the SD # This assumption is safe right now (alpha9) but should be removed asap def update_sd(paths,creds,session,names): sam_ldb = Ldb(paths.samdb, session_info=session, credentials=creds,lp=lp,options=["modules:samba_dsdb"]) sam_ldb.transaction_start() # First update the SD for the rootdn sam_ldb.set_session_info(session) res = sam_ldb.search(expression="objectClass=*",base=str(names.rootdn), scope=SCOPE_BASE,attrs=["dn","whenCreated"],controls=["search_options:1:2"]) delta = ldb.Message() delta.dn = ldb.Dn(sam_ldb,str(res[0]["dn"])) descr = get_domain_descriptor(names.domainsid) delta["nTSecurityDescriptor"] = ldb.MessageElement( descr,ldb.FLAG_MOD_REPLACE,"nTSecurityDescriptor" ) sam_ldb.modify(delta,["recalculate_sd:0"]) # Then the config dn res = sam_ldb.search(expression="objectClass=*",base=str(names.configdn), scope=SCOPE_BASE,attrs=["dn","whenCreated"],controls=["search_options:1:2"]) delta = ldb.Message() delta.dn = ldb.Dn(sam_ldb,str(res[0]["dn"])) descr = get_config_descriptor(names.domainsid) delta["nTSecurityDescriptor"] = ldb.MessageElement( descr,ldb.FLAG_MOD_REPLACE,"nTSecurityDescriptor" ) sam_ldb.modify(delta,["recalculate_sd:0"]) # Then the schema dn res = sam_ldb.search(expression="objectClass=*",base=str(names.schemadn), scope=SCOPE_BASE,attrs=["dn","whenCreated"],controls=["search_options:1:2"]) delta = ldb.Message() delta.dn = ldb.Dn(sam_ldb,str(res[0]["dn"])) descr = get_schema_descriptor(names.domainsid) delta["nTSecurityDescriptor"] = ldb.MessageElement( descr,ldb.FLAG_MOD_REPLACE,"nTSecurityDescriptor" ) sam_ldb.modify(delta,["recalculate_sd:0"]) # Then the rest hash = {} res = sam_ldb.search(expression="objectClass=*",base=str(names.rootdn), scope=SCOPE_SUBTREE,attrs=["dn","whenCreated"],controls=["search_options:1:2"]) for obj in res: if not (str(obj["dn"]) == str(names.rootdn) or str(obj["dn"]) == str(names.configdn) or \ str(obj["dn"]) == str(names.schemadn)): hash[str(obj["dn"])] = obj["whenCreated"] listkeys = hash.keys() listkeys.sort(dn_sort) for key in listkeys: try: delta = ldb.Message() delta.dn = ldb.Dn(sam_ldb,key) delta["whenCreated"] = ldb.MessageElement( hash[key],ldb.FLAG_MOD_REPLACE,"whenCreated" ) sam_ldb.modify(delta,["recalculate_sd:0"]) except: sam_ldb.transaction_cancel() res = sam_ldb.search(expression="objectClass=*",base=str(names.rootdn), scope=SCOPE_SUBTREE,attrs=["dn","nTSecurityDescriptor"],controls=["search_options:1:2"]) print "bad stuff" +ndr_unpack(security.descriptor,str(res[0]["nTSecurityDescriptor"])).as_sddl(names.domainsid) return sam_ldb.transaction_commit() def rmall(topdir): for root, dirs, files in os.walk(topdir, topdown=False): for name in files: os.remove(os.path.join(root, name)) for name in dirs: os.rmdir(os.path.join(root, name)) os.rmdir(topdir) def update_basesamdb(newpaths,paths,names): message(SIMPLE,"Copy samdb") shutil.copy(newpaths.samdb,paths.samdb) message(SIMPLE,"Update partitions filename if needed") schemaldb=os.path.join(paths.private_dir,"schema.ldb") configldb=os.path.join(paths.private_dir,"configuration.ldb") usersldb=os.path.join(paths.private_dir,"users.ldb") samldbdir=os.path.join(paths.private_dir,"sam.ldb.d") if not os.path.isdir(samldbdir): os.mkdir(samldbdir) os.chmod(samldbdir,0700) if os.path.isfile(schemaldb): shutil.copy(schemaldb,os.path.join(samldbdir,"%s.ldb"%str(names.schemadn).upper())) os.remove(schemaldb) if os.path.isfile(usersldb): shutil.copy(usersldb,os.path.join(samldbdir,"%s.ldb"%str(names.rootdn).upper())) os.remove(usersldb) if os.path.isfile(configldb): shutil.copy(configldb,os.path.join(samldbdir,"%s.ldb"%str(names.configdn).upper())) os.remove(configldb) def update_privilege(newpaths,paths): message(SIMPLE,"Copy privilege") shutil.copy(os.path.join(newpaths.private_dir,"privilege.ldb"),os.path.join(paths.private_dir,"privilege.ldb")) # For each partition check the differences def update_samdb(newpaths,paths,creds,session,names): message(SIMPLE, "Doing schema update") hashdef = check_diff_name(newpaths,paths,creds,session,str(names.schemadn),names,1) message(SIMPLE,"Done with schema update") message(SIMPLE,"Scanning whole provision for updates and additions") hashSD = check_diff_name(newpaths,paths,creds,session,str(names.rootdn),names,0) message(SIMPLE,"Done with scanning") def update_machine_account_password(paths,creds,session,names): secrets_ldb = Ldb(paths.secrets, session_info=session, credentials=creds,lp=lp) secrets_ldb.transaction_start() secrets_msg = secrets_ldb.search(expression=("samAccountName=%s$" % names.netbiosname), attrs=["secureChannelType"]) sam_ldb = Ldb(paths.samdb, session_info=session, credentials=creds,lp=lp) sam_ldb.transaction_start() if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC: res = sam_ldb.search(expression=("samAccountName=%s$" % names.netbiosname), attrs=[]) assert(len(res) == 1) msg = ldb.Message(res[0].dn) machinepass = glue.generate_random_str(12) msg["userPassword"] = ldb.MessageElement(machinepass, ldb.FLAG_MOD_REPLACE, "userPassword") sam_ldb.modify(msg) res = sam_ldb.search(expression=("samAccountName=%s$" % names.netbiosname), attrs=["msDs-keyVersionNumber"]) assert(len(res) == 1) kvno = int(str(res[0]["msDs-keyVersionNumber"])) secretsdb_self_join(secrets_ldb, domain=names.domain, realm=names.realm, domainsid=names.domainsid, dnsdomain=names.dnsdomain, netbiosname=names.netbiosname, machinepass=machinepass, key_version_number=kvno, secure_channel_type=int(secrets_msg[0]["secureChannelType"][0])) sam_ldb.transaction_prepare_commit() secrets_ldb.transaction_prepare_commit() sam_ldb.transaction_commit() secrets_ldb.transaction_commit() else: secrets_ldb.transaction_cancel() # From here start the big steps of the program # First get files paths paths=get_paths(smbconf=smbconf) paths.setup = setup_dir def setup_path(file): return os.path.join(setup_dir, file) # Guess all the needed names (variables in fact) from the current # provision. names = guess_names_from_current_provision(creds,session,paths) if not sanitychecks(creds,session,names,paths): print "Sanity checks for the upgrade fails, checks messages and correct it before rerunning upgradeprovision" sys.exit(1) # Let's see them print_names(names) # With all this information let's create a fresh new provision used as reference provisiondir = newprovision(names,setup_dir,creds,session,smbconf) # Get file paths of this new provision newpaths = get_paths(targetdir=provisiondir) populate_backlink(newpaths,creds,session,names.schemadn) populate_dnsyntax(newpaths,creds,session,names.schemadn) # Check the difference update_basesamdb(newpaths,paths,names) if opts.full: update_samdb(newpaths,paths,creds,session,names) update_secrets(newpaths,paths,creds,session) update_privilege(newpaths,paths) update_machine_account_password(paths,creds,session,names) # SD should be created with admin but as some previous acl were so wrong that admin can't modify them we have first # to recreate them with the good form but with system account and then give the ownership to admin ... admin_session_info = admin_session(lp, str(names.domainsid)) message(SIMPLE,"Updating SD") update_sd(paths,creds,session,names) update_sd(paths,creds,admin_session_info,names) check_updated_sd(newpaths,paths,creds,session,names) message(SIMPLE,"Upgrade finished !") # remove reference provision now that everything is done ! rmall(provisiondir)