1 # Helpers for provision stuff
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
4 # Based on provision a Samba4 server by
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 """Helpers used for upgrading between different database formats."""
29 from samba import Ldb, version, ntacls
30 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
32 from samba.provision import (provision_paths_from_lp,
33 getpolicypath, set_gpos_acl, create_gpo_struct,
34 FILL_FULL, provision, ProvisioningError,
35 setsysvolacl, secretsdb_self_join)
36 from samba.dcerpc import xattr, drsblobs
37 from samba.dcerpc.misc import SEC_CHAN_BDC
38 from samba.ndr import ndr_unpack
39 from samba.samdb import SamDB
40 from samba import _glue
43 # All the ldb related to registry are commented because the path for them is
44 # relative in the provisionPath object
45 # And so opening them create a file in the current directory which is not what
47 # I still keep them commented because I plan soon to make more cleaner
56 hashAttrNotCopied = set(["dn", "whenCreated", "whenChanged", "objectGUID",
57 "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
58 "objectCategory", "distinguishedName", "nTMixedDomain",
59 "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
60 "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
61 "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
62 "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
63 "possibleInferiors", "privilege", "sAMAccountType"])
66 class ProvisionLDB(object):
79 return (self.sam, self.secrets, self.idmap, self.privilege)
81 def startTransactions(self):
83 db.transaction_start()
85 # self.hkcr.transaction_start()
86 # self.hkcu.transaction_start()
87 # self.hku.transaction_start()
88 # self.hklm.transaction_start()
90 def groupedRollback(self):
94 db.transaction_cancel()
99 # self.hkcr.transaction_cancel()
100 # self.hkcu.transaction_cancel()
101 # self.hku.transaction_cancel()
102 # self.hklm.transaction_cancel()
104 def groupedCommit(self):
106 for db in self.dbs():
107 db.transaction_prepare_commit()
109 return self.groupedRollback()
111 # self.hkcr.transaction_prepare_commit()
112 # self.hkcu.transaction_prepare_commit()
113 # self.hku.transaction_prepare_commit()
114 # self.hklm.transaction_prepare_commit()
116 for db in self.dbs():
117 db.transaction_commit()
119 return self.groupedRollback()
122 # self.hkcr.transaction_commit()
123 # self.hkcu.transaction_commit()
124 # self.hku.transaction_commit()
125 # self.hklm.transaction_commit()
129 def get_ldbs(paths, creds, session, lp):
130 """Return LDB object mapped on most important databases
132 :param paths: An object holding the different importants paths for provision object
133 :param creds: Credential used for openning LDB files
134 :param session: Session to use for openning LDB files
135 :param lp: A loadparam object
136 :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
138 ldbs = ProvisionLDB()
140 ldbs.sam = SamDB(paths.samdb, session_info=session, credentials=creds, lp=lp, options=["modules:samba_dsdb"])
141 ldbs.secrets = Ldb(paths.secrets, session_info=session, credentials=creds, lp=lp)
142 ldbs.idmap = Ldb(paths.idmapdb, session_info=session, credentials=creds, lp=lp)
143 ldbs.privilege = Ldb(paths.privilege, session_info=session, credentials=creds, lp=lp)
144 # ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
145 # ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
146 # ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
147 # ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
152 def usn_in_range(usn, range):
153 """Check if the usn is in one of the range provided.
154 To do so, the value is checked to be between the lower bound and
155 higher bound of a range
157 :param usn: A integer value corresponding to the usn that we want to update
158 :param range: A list of integer representing ranges, lower bounds are in
159 the even indices, higher in odd indices
160 :return: True if the usn is in one of the range, False otherwise
167 if idx == len(range):
170 if usn < int(range[idx]):
174 if usn == int(range[idx]):
181 def get_paths(param, targetdir=None, smbconf=None):
182 """Get paths to important provision objects (smb.conf, ldb files, ...)
184 :param param: Param object
185 :param targetdir: Directory where the provision is (or will be) stored
186 :param smbconf: Path to the smb.conf file
187 :return: A list with the path of important provision objects"""
188 if targetdir is not None:
189 if not os.path.exists(targetdir):
191 etcdir = os.path.join(targetdir, "etc")
192 if not os.path.exists(etcdir):
194 smbconf = os.path.join(etcdir, "smb.conf")
196 smbconf = param.default_path()
198 if not os.path.exists(smbconf):
199 raise ProvisioningError("Unable to find smb.conf")
201 lp = param.LoadParm()
203 paths = provision_paths_from_lp(lp, lp.get("realm"))
206 def update_policyids(names, samdb):
207 """Update policy ids that could have changed after sam update
209 :param names: List of key provision parameters
210 :param samdb: An Ldb object conntected with the sam DB
213 res = samdb.search(expression="(displayName=Default Domain Policy)",
214 base="CN=Policies,CN=System," + str(names.rootdn),
215 scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
216 names.policyid = str(res[0]["cn"]).replace("{","").replace("}","")
218 res2 = samdb.search(expression="(displayName=Default Domain Controllers"
220 base="CN=Policies,CN=System," + str(names.rootdn),
221 scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
223 names.policyid_dc = str(res2[0]["cn"]).replace("{","").replace("}","")
225 names.policyid_dc = None
228 def newprovision(names, creds, session, smbconf, provdir, logger):
229 """Create a new provision.
231 This provision will be the reference for knowing what has changed in the
232 since the latest upgrade in the current provision
234 :param names: List of provision parameters
235 :param creds: Credentials for the authentification
236 :param session: Session object
237 :param smbconf: Path to the smb.conf file
238 :param provdir: Directory where the provision will be stored
239 :param logger: A Logger
241 if os.path.isdir(provdir):
242 shutil.rmtree(provdir)
244 logger.info("Provision stored in %s", provdir)
245 return provision(logger, session, creds, smbconf=smbconf,
246 targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm,
247 domain=names.domain, domainguid=names.domainguid,
248 domainsid=str(names.domainsid), ntdsguid=names.ntdsguid,
249 policyguid=names.policyid, policyguid_dc=names.policyid_dc,
250 hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
251 invocationid=names.invocation, adminpass=names.adminpass,
252 krbtgtpass=None, machinepass=None, dnspass=None, root=None,
253 nobody=None, users=None,
254 serverrole="domain controller",
255 backend_type=None, ldapadminpass=None, ol_mmr_urls=None,
257 dom_for_fun_level=names.domainlevel, dns_backend=names.dns_backend,
258 useeadb=True, use_ntvfs=True)
262 """Sorts two DNs in the lexicographical order it and put higher level DN
265 So given the dns cn=bar,cn=foo and cn=foo the later will be return as
268 :param x: First object to compare
269 :param y: Second object to compare
271 p = re.compile(r'(?<!\\), ?')
272 tab1 = p.split(str(x))
273 tab2 = p.split(str(y))
274 minimum = min(len(tab1), len(tab2))
277 # Note: python range go up to upper limit but do not include it
278 for i in range(0, minimum):
279 ret = cmp(tab1[len1-i], tab2[len2-i])
284 assert len1!=len2,"PB PB PB" + " ".join(tab1)+" / " + " ".join(tab2)
292 def identic_rename(ldbobj, dn):
293 """Perform a back and forth rename to trigger renaming on attribute that
294 can't be directly modified.
296 :param lbdobj: An Ldb Object
297 :param dn: DN of the object to manipulate
299 (before, after) = str(dn).split('=', 1)
300 # we need to use relax to avoid the subtree_rename constraints
301 ldbobj.rename(dn, ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), ["relax:0"])
302 ldbobj.rename(ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), dn, ["relax:0"])
306 """Return separate ACE of an ACL
308 :param acl: A string representing the ACL
309 :return: A hash with different parts
312 p = re.compile(r'(\w+)?(\(.*?\))')
320 hash["aces"].append(e[1])
325 def chunck_sddl(sddl):
326 """ Return separate parts of the SDDL (owner, group, ...)
328 :param sddl: An string containing the SDDL to chunk
329 :return: A hash with the different chunk
332 p = re.compile(r'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
333 tab = p.findall(sddl)
349 def get_diff_sddls(refsddl, cursddl, checkSacl = True):
350 """Get the difference between 2 sddl
352 This function split the textual representation of ACL into smaller
353 chunck in order to not to report a simple permutation as a difference
355 :param refsddl: First sddl to compare
356 :param cursddl: Second sddl to compare
357 :param checkSacl: If false we skip the sacl checks
358 :return: A string that explain difference between sddls
362 hash_cur = chunck_sddl(cursddl)
363 hash_ref = chunck_sddl(refsddl)
365 if not hash_cur.has_key("owner"):
366 txt = "\tNo owner in current SD"
367 elif hash_cur["owner"] != hash_ref["owner"]:
368 txt = "\tOwner mismatch: %s (in ref) %s" \
369 "(in current)\n" % (hash_ref["owner"], hash_cur["owner"])
371 if not hash_cur.has_key("group"):
372 txt = "%s\tNo group in current SD" % txt
373 elif hash_cur["group"] != hash_ref["group"]:
374 txt = "%s\tGroup mismatch: %s (in ref) %s" \
375 "(in current)\n" % (txt, hash_ref["group"], hash_cur["group"])
381 if hash_cur.has_key(part) and hash_ref.has_key(part):
383 # both are present, check if they contain the same ACE
386 c_cur = chunck_acl(hash_cur[part])
387 c_ref = chunck_acl(hash_ref[part])
389 for elem in c_cur["aces"]:
392 for elem in c_ref["aces"]:
400 if len(h_cur) + len(h_ref) > 0:
401 txt = "%s\tPart %s is different between reference" \
402 " and current here is the detail:\n" % (txt, part)
405 txt = "%s\t\t%s ACE is not present in the" \
406 " reference\n" % (txt, item)
409 txt = "%s\t\t%s ACE is not present in the" \
410 " current\n" % (txt, item)
412 elif hash_cur.has_key(part) and not hash_ref.has_key(part):
413 txt = "%s\tReference ACL hasn't a %s part\n" % (txt, part)
414 elif not hash_cur.has_key(part) and hash_ref.has_key(part):
415 txt = "%s\tCurrent ACL hasn't a %s part\n" % (txt, part)
420 def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
421 """Update secrets.ldb
423 :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
424 of the reference provision
425 :param secrets_ldb: An LDB object that is connected to the secrets.ldb
426 of the updated provision
429 messagefunc(SIMPLE, "Update of secrets.ldb")
430 reference = newsecrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
431 current = secrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
432 assert reference, "Reference modules list can not be empty"
433 if len(current) == 0:
435 delta = secrets_ldb.msg_diff(ldb.Message(), reference[0])
436 delta.dn = reference[0].dn
437 secrets_ldb.add(reference[0])
439 delta = secrets_ldb.msg_diff(current[0], reference[0])
440 delta.dn = current[0].dn
441 secrets_ldb.modify(delta)
443 reference = newsecrets_ldb.search(expression="objectClass=top", base="",
444 scope=SCOPE_SUBTREE, attrs=["dn"])
445 current = secrets_ldb.search(expression="objectClass=top", base="",
446 scope=SCOPE_SUBTREE, attrs=["dn"])
452 empty = ldb.Message()
453 for i in range(0, len(reference)):
454 hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"]
456 # Create a hash for speeding the search of existing object in the
458 for i in range(0, len(current)):
459 hash[str(current[i]["dn"]).lower()] = current[i]["dn"]
461 for k in hash_new.keys():
462 if not hash.has_key(k):
463 listMissing.append(hash_new[k])
465 listPresent.append(hash_new[k])
467 for entry in listMissing:
468 reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
469 base="", scope=SCOPE_SUBTREE)
470 current = secrets_ldb.search(expression="distinguishedName=%s" % entry,
471 base="", scope=SCOPE_SUBTREE)
472 delta = secrets_ldb.msg_diff(empty, reference[0])
473 for att in hashAttrNotCopied:
475 messagefunc(CHANGE, "Entry %s is missing from secrets.ldb" %
478 messagefunc(CHANGE, " Adding attribute %s" % att)
479 delta.dn = reference[0].dn
480 secrets_ldb.add(delta)
482 for entry in listPresent:
483 reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
484 base="", scope=SCOPE_SUBTREE)
485 current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
487 delta = secrets_ldb.msg_diff(current[0], reference[0])
488 for att in hashAttrNotCopied:
492 messagefunc(CHANGE, "Found attribute name on %s,"
493 " must rename the DN" % (current[0].dn))
494 identic_rename(secrets_ldb, reference[0].dn)
498 for entry in listPresent:
499 reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
501 current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
503 delta = secrets_ldb.msg_diff(current[0], reference[0])
504 for att in hashAttrNotCopied:
507 if att == "msDS-KeyVersionNumber":
511 "Adding/Changing attribute %s to %s" %
512 (att, current[0].dn))
514 delta.dn = current[0].dn
515 secrets_ldb.modify(delta)
517 res2 = secrets_ldb.search(expression="(samaccountname=dns)",
518 scope=SCOPE_SUBTREE, attrs=["dn"])
521 messagefunc(SIMPLE, "Remove old dns account")
522 secrets_ldb.delete(res2[0]["dn"])
525 def getOEMInfo(samdb, rootdn):
526 """Return OEM Information on the top level Samba4 use to store version
529 :param samdb: An LDB object connect to sam.ldb
530 :param rootdn: Root DN of the domain
531 :return: The content of the field oEMInformation (if any)
533 res = samdb.search(expression="(objectClass=*)", base=str(rootdn),
534 scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
535 if len(res) > 0 and res[0].get("oEMInformation"):
536 info = res[0]["oEMInformation"]
542 def updateOEMInfo(samdb, rootdn):
543 """Update the OEMinfo field to add information about upgrade
545 :param samdb: an LDB object connected to the sam DB
546 :param rootdn: The string representation of the root DN of
547 the provision (ie. DC=...,DC=...)
549 res = samdb.search(expression="(objectClass=*)", base=rootdn,
550 scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
552 if res[0].get("oEMInformation"):
553 info = str(res[0]["oEMInformation"])
556 info = "%s, upgrade to %s" % (info, version)
557 delta = ldb.Message()
558 delta.dn = ldb.Dn(samdb, str(res[0]["dn"]))
559 delta["oEMInformation"] = ldb.MessageElement(info, ldb.FLAG_MOD_REPLACE,
563 def update_gpo(paths, samdb, names, lp, message, force=0):
564 """Create missing GPO file object if needed
566 Set ACL correctly also.
567 Check ACLs for sysvol/netlogon dirs also
571 ntacls.checkset_backend(lp, None, None)
572 eadbname = lp.get("posix:eadb")
573 if eadbname is not None and eadbname != "":
575 attribute = samba.xattr_tdb.wrap_getxattr(eadbname,
576 paths.sysvol, xattr.XATTR_NTACL_NAME)
578 attribute = samba.xattr_native.wrap_getxattr(paths.sysvol,
579 xattr.XATTR_NTACL_NAME)
581 attribute = samba.xattr_native.wrap_getxattr(paths.sysvol,
582 xattr.XATTR_NTACL_NAME)
589 dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid)
590 if not os.path.isdir(dir):
591 create_gpo_struct(dir)
593 if names.policyid_dc is None:
594 raise ProvisioningError("Policy ID for Domain controller is missing")
595 dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
596 if not os.path.isdir(dir):
597 create_gpo_struct(dir)
600 if os.geteuid() == 0:
601 message(ERROR, "Unable to set ACLs on policies related objects: %s" % e)
603 message(ERROR, "Unable to set ACLs on policies related objects. "
604 "ACLs must be set as root if file system ACLs "
605 "(rather than posix:eadb) are used.")
607 # We always reinforce acls on GPO folder because they have to be in sync
610 set_gpos_acl(paths.sysvol, names.dnsdomain, names.domainsid,
611 names.domaindn, samdb, lp)
617 setsysvolacl(samdb, paths.netlogon, paths.sysvol, names.root_gid,
618 names.domainsid, names.dnsdomain, names.domaindn, lp)
623 def increment_calculated_keyversion_number(samdb, rootdn, hashDns):
624 """For a given hash associating dn and a number, this function will
625 update the replPropertyMetaData of each dn in the hash, so that the
626 calculated value of the msDs-KeyVersionNumber is equal or superior to the
627 one associated to the given dn.
629 :param samdb: An SamDB object pointing to the sam
630 :param rootdn: The base DN where we want to start
631 :param hashDns: A hash with dn as key and number representing the
632 minimum value of msDs-KeyVersionNumber that we want to
635 entry = samdb.search(expression='(objectClass=user)',
636 base=ldb.Dn(samdb,str(rootdn)),
637 scope=SCOPE_SUBTREE, attrs=["msDs-KeyVersionNumber"],
638 controls=["search_options:1:2"])
642 raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
645 if hashDns.has_key(str(e.dn).lower()):
646 val = e.get("msDs-KeyVersionNumber")
649 version = int(str(hashDns[str(e.dn).lower()]))
650 if int(str(val)) < version:
652 samdb.set_attribute_replmetadata_version(str(e.dn),
655 def delta_update_basesamdb(refsampath, sampath, creds, session, lp, message):
656 """Update the provision container db: sam.ldb
657 This function is aimed for alpha9 and newer;
659 :param refsampath: Path to the samdb in the reference provision
660 :param sampath: Path to the samdb in the upgraded provision
661 :param creds: Credential used for openning LDB files
662 :param session: Session to use for openning LDB files
663 :param lp: A loadparam object
664 :return: A msg_diff object with the difference between the @ATTRIBUTES
665 of the current provision and the reference provision
669 "Update base samdb by searching difference with reference one")
670 refsam = Ldb(refsampath, session_info=session, credentials=creds,
671 lp=lp, options=["modules:"])
672 sam = Ldb(sampath, session_info=session, credentials=creds, lp=lp,
673 options=["modules:"])
675 empty = ldb.Message()
677 reference = refsam.search(expression="")
679 for refentry in reference:
680 entry = sam.search(expression="distinguishedName=%s" % refentry["dn"],
683 delta = sam.msg_diff(empty, refentry)
684 message(CHANGE, "Adding %s to sam db" % str(refentry.dn))
685 if str(refentry.dn) == "@PROVISION" and\
686 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
687 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
688 delta.dn = refentry.dn
691 delta = sam.msg_diff(entry[0], refentry)
692 if str(refentry.dn) == "@ATTRIBUTES":
693 deltaattr = sam.msg_diff(refentry, entry[0])
694 if str(refentry.dn) == "@PROVISION" and\
695 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
696 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
697 if len(delta.items()) > 1:
698 delta.dn = refentry.dn
704 def construct_existor_expr(attrs):
705 """Construct a exists or LDAP search expression.
707 :param attrs: List of attribute on which we want to create the search
709 :return: A string representing the expression, if attrs is empty an
710 empty string is returned
716 expr = "%s(%s=*)"%(expr,att)
720 def update_machine_account_password(samdb, secrets_ldb, names):
721 """Update (change) the password of the current DC both in the SAM db and in
724 :param samdb: An LDB object related to the sam.ldb file of a given provision
725 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
727 :param names: List of key provision parameters"""
729 expression = "samAccountName=%s$" % names.netbiosname
730 secrets_msg = secrets_ldb.search(expression=expression,
731 attrs=["secureChannelType"])
732 if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC:
733 res = samdb.search(expression=expression, attrs=[])
734 assert(len(res) == 1)
736 msg = ldb.Message(res[0].dn)
737 machinepass = samba.generate_random_password(128, 255)
738 mputf16 = machinepass.encode('utf-16-le')
739 msg["clearTextPassword"] = ldb.MessageElement(mputf16,
740 ldb.FLAG_MOD_REPLACE,
744 res = samdb.search(expression=("samAccountName=%s$" % names.netbiosname),
745 attrs=["msDs-keyVersionNumber"])
746 assert(len(res) == 1)
747 kvno = int(str(res[0]["msDs-keyVersionNumber"]))
748 secChanType = int(secrets_msg[0]["secureChannelType"][0])
750 secretsdb_self_join(secrets_ldb, domain=names.domain,
752 domainsid=names.domainsid,
753 dnsdomain=names.dnsdomain,
754 netbiosname=names.netbiosname,
755 machinepass=machinepass,
756 key_version_number=kvno,
757 secure_channel_type=secChanType)
759 raise ProvisioningError("Unable to find a Secure Channel"
760 "of type SEC_CHAN_BDC")
762 def update_dns_account_password(samdb, secrets_ldb, names):
763 """Update (change) the password of the dns both in the SAM db and in
766 :param samdb: An LDB object related to the sam.ldb file of a given provision
767 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
769 :param names: List of key provision parameters"""
771 expression = "samAccountName=dns-%s" % names.netbiosname
772 secrets_msg = secrets_ldb.search(expression=expression)
773 if len(secrets_msg) == 1:
774 res = samdb.search(expression=expression, attrs=[])
775 assert(len(res) == 1)
777 msg = ldb.Message(res[0].dn)
778 machinepass = samba.generate_random_password(128, 255)
779 mputf16 = machinepass.encode('utf-16-le')
780 msg["clearTextPassword"] = ldb.MessageElement(mputf16,
781 ldb.FLAG_MOD_REPLACE,
786 res = samdb.search(expression=expression,
787 attrs=["msDs-keyVersionNumber"])
788 assert(len(res) == 1)
789 kvno = str(res[0]["msDs-keyVersionNumber"])
791 msg = ldb.Message(secrets_msg[0].dn)
792 msg["secret"] = ldb.MessageElement(machinepass,
793 ldb.FLAG_MOD_REPLACE,
795 msg["msDS-KeyVersionNumber"] = ldb.MessageElement(kvno,
796 ldb.FLAG_MOD_REPLACE,
797 "msDS-KeyVersionNumber")
799 secrets_ldb.modify(msg)
801 def search_constructed_attrs_stored(samdb, rootdn, attrs):
802 """Search a given sam DB for calculated attributes that are
803 still stored in the db.
805 :param samdb: An LDB object pointing to the sam
806 :param rootdn: The base DN where the search should start
807 :param attrs: A list of attributes to be searched
808 :return: A hash with attributes as key and an array of
809 array. Each array contains the dn and the associated
810 values for this attribute as they are stored in the
814 expr = construct_existor_expr(attrs)
817 entry = samdb.search(expression=expr, base=ldb.Dn(samdb, str(rootdn)),
818 scope=SCOPE_SUBTREE, attrs=attrs,
819 controls=["search_options:1:2","bypassoperational:0"])
827 if hashAtt.has_key(att):
828 hashAtt[att][str(ent.dn).lower()] = str(ent[att])
831 hashAtt[att][str(ent.dn).lower()] = str(ent[att])
835 def findprovisionrange(samdb, basedn):
836 """ Find ranges of usn grouped by invocation id and then by timestamp
839 :param samdb: An LDB object pointing to the samdb
840 :param basedn: The DN of the forest
842 :return: A two level dictionary with invoication id as the
843 first level, timestamp as the second one and then
844 max, min, and number as subkeys, representing respectivily
845 the maximum usn for the range, the minimum usn and the number
846 of object with usn in this range.
851 res = samdb.search(base=basedn, expression="objectClass=*",
852 scope=ldb.SCOPE_SUBTREE,
853 attrs=["replPropertyMetaData"],
854 controls=["search_options:1:2"])
858 obj = ndr_unpack(drsblobs.replPropertyMetaDataBlob,
859 str(e["replPropertyMetaData"])).ctr
862 # like a timestamp but with the resolution of 1 minute
863 minutestamp =_glue.nttime2unix(o.originating_change_time)/60
864 hash_ts = hash_id.get(str(o.originating_invocation_id))
868 ob["min"] = o.originating_usn
869 ob["max"] = o.originating_usn
871 ob["list"] = [str(e.dn)]
874 ob = hash_ts.get(minutestamp)
877 ob["min"] = o.originating_usn
878 ob["max"] = o.originating_usn
880 ob["list"] = [str(e.dn)]
882 if ob["min"] > o.originating_usn:
883 ob["min"] = o.originating_usn
884 if ob["max"] < o.originating_usn:
885 ob["max"] = o.originating_usn
886 if not (str(e.dn) in ob["list"]):
887 ob["num"] = ob["num"] + 1
888 ob["list"].append(str(e.dn))
889 hash_ts[minutestamp] = ob
890 hash_id[str(o.originating_invocation_id)] = hash_ts
892 return (hash_id, nb_obj)
894 def print_provision_ranges(dic, limit_print, dest, samdb_path, invocationid):
895 """ print the differents ranges passed as parameter
897 :param dic: A dictionnary as returned by findprovisionrange
898 :param limit_print: minimum number of object in a range in order to print it
899 :param dest: Destination directory
900 :param samdb_path: Path to the sam.ldb file
901 :param invoicationid: Invocation ID for the current provision
908 sorted_keys.extend(hash_ts.keys())
912 for k in sorted_keys:
914 if obj["num"] > limit_print:
915 dt = _glue.nttime2string(_glue.unix2nttime(k*60))
916 print "%s # of modification: %d \tmin: %d max: %d" % (dt , obj["num"],
919 if hash_ts[k]["num"] > 600:
920 kept_record.append(k)
922 # Let's try to concatenate consecutive block if they are in the almost same minutestamp
923 for i in range(0, len(kept_record)):
925 key1 = kept_record[i]
926 key2 = kept_record[i-1]
928 # previous record is just 1 minute away from current
929 if int(hash_ts[key1]["min"]) == int(hash_ts[key2]["max"]) + 1:
930 # Copy the highest USN in the previous record
931 # and mark the current as skipped
932 hash_ts[key2]["max"] = hash_ts[key1]["max"]
933 hash_ts[key1]["skipped"] = True
935 for k in kept_record:
937 if obj.get("skipped") is None:
938 ldif = "%slastProvisionUSN: %d-%d;%s\n" % (ldif, obj["min"],
942 file = tempfile.mktemp(dir=dest, prefix="usnprov", suffix=".ldif")
944 print "To track the USNs modified/created by provision and upgrade proivsion,"
945 print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
946 print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
947 print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path),file)
948 ldif = "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid, ldif)
949 open(file,'w').write(ldif)
951 def int64range2str(value):
952 """Display the int64 range stored in value as xxx-yyy
954 :param value: The int64 range
955 :return: A string of the representation of the range
959 str = "%d-%d" % (lvalue&0xFFFFFFFF, lvalue>>32)