import os
import sys
import random
+import copy
# ensure we get messages out immediately, so they get in the samba logs,
# and don't get swallowed by a timeout
from samba import getopt as options
from samba.auth import system_session
from samba.samdb import SamDB
+from samba.dcerpc import drsuapi
from samba.kcc_utils import *
class KCC:
our local DCs partitions or all the partitions in
the forest
"""
- self.dsa_table = {} # dsa objects
- self.part_table = {} # partition objects
- self.site_table = {}
+ self.part_table = {} # partition objects
+ self.site_table = {}
+ self.transport_table = {}
+
self.my_dsa_dnstr = None # My dsa DN
+ self.my_dsa = None # My dsa object
+
self.my_site_dnstr = None
+ self.my_site = None
+
self.samdb = samdb
+ return
+
+ def load_all_transports(self):
+ """Loads the inter-site transport objects for Sites
+ Raises an Exception on error
+ """
+ try:
+ res = samdb.search("CN=Inter-Site Transports,CN=Sites,%s" % \
+ samdb.get_config_basedn(),
+ scope=ldb.SCOPE_SUBTREE,
+ expression="(objectClass=interSiteTransport)")
+ except ldb.LdbError, (enum, estr):
+ raise Exception("Unable to find inter-site transports - (%s)" % estr)
+
+ for msg in res:
+ dnstr = str(msg.dn)
+
+ # already loaded
+ if dnstr in self.transport_table.keys():
+ continue
+
+ transport = Transport(dnstr)
+
+ transport.load_transport(samdb)
+
+ # Assign this transport to table
+ # and index by dn
+ self.transport_table[dnstr] = transport
+
+ return
def load_my_site(self):
"""Loads the Site class for the local DSA
self.my_site_dnstr = "CN=%s,CN=Sites,%s" % (samdb.server_site_name(),
samdb.get_config_basedn())
site = Site(self.my_site_dnstr)
-
site.load_site(samdb)
+
self.site_table[self.my_site_dnstr] = site
+ self.my_site = site
+ return
def load_my_dsa(self):
- """Discover my nTDSDSA thru the rootDSE entry and
- instantiate and load the DSA. The dsa is inserted
- into the dsa_table by dn string
+ """Discover my nTDSDSA dn thru the rootDSE entry
Raises an Exception on error.
"""
dn = ldb.Dn(self.samdb, "")
except ldb.LdbError, (enum, estr):
raise Exception("Unable to find my nTDSDSA - (%s)" % estr)
- dnstr = res[0]["dsServiceName"][0]
-
- # already loaded
- if dnstr in self.dsa_table.keys():
- return
-
- self.my_dsa_dnstr = dnstr
- dsa = DirectoryServiceAgent(dnstr)
-
- dsa.load_dsa(samdb)
-
- # Assign this dsa to my dsa table
- # and index by dsa dn
- self.dsa_table[dnstr] = dsa
-
- def load_all_dsa(self):
- """Discover all nTDSDSA thru the sites entry and
- instantiate and load the DSAs. Each dsa is inserted
- into the dsa_table by dn string.
- Raises an Exception on error.
- """
- try:
- res = self.samdb.search("CN=Sites,%s" %
- self.samdb.get_config_basedn(),
- scope=ldb.SCOPE_SUBTREE,
- expression="(objectClass=nTDSDSA)")
- except ldb.LdbError, (enum, estr):
- raise Exception("Unable to find nTDSDSAs - (%s)" % estr)
+ self.my_dsa_dnstr = res[0]["dsServiceName"][0]
+ self.my_dsa = self.my_site.get_dsa(self.my_dsa_dnstr)
- for msg in res:
- dnstr = str(msg.dn)
-
- # already loaded
- if dnstr in self.dsa_table.keys():
- continue
-
- dsa = DirectoryServiceAgent(dnstr)
-
- dsa.load_dsa(self.samdb)
-
- # Assign this dsa to my dsa table
- # and index by dsa dn
- self.dsa_table[dnstr] = dsa
+ return
def load_all_partitions(self):
"""Discover all NCs thru the Partitions dn and
self.part_table[partstr] = part
def should_be_present_test(self):
- """Enumerate all loaded partitions and DSAs and test
- if NC should be present as replica
+ """Enumerate all loaded partitions and DSAs in local
+ site and test if NC should be present as replica
"""
for partdn, part in self.part_table.items():
-
- for dsadn, dsa in self.dsa_table.items():
+ for dsadn, dsa in self.my_site.dsa_table.items():
needed, ro, partial = part.should_be_present(dsa)
-
logger.info("dsadn:%s\nncdn:%s\nneeded=%s:ro=%s:partial=%s\n" % \
- (dsa.dsa_dnstr, part.nc_dnstr, needed, ro, partial))
+ (dsadn, part.nc_dnstr, needed, ro, partial))
+ return
def refresh_failed_links_connections(self):
# XXX - not implemented yet
# XXX - not implemented yet
return
- def remove_unneeded_ntds_connections(self):
+ def remove_unneeded_ntdsconn(self):
# XXX - not implemented yet
return
- def translate_connections(self):
- # XXX - not implemented yet
+ def get_dsa_by_guidstr(self, guidstr):
+ """Given a DSA guid string, consule all sites looking
+ for the corresponding DSA and return it.
+ """
+ for site in self.site_table.values():
+ dsa = site.get_dsa_by_guidstr(guidstr)
+ if dsa is not None:
+ return dsa
+ return None
+
+ def get_dsa(self, dnstr):
+ """Given a DSA dn string, consule all sites looking
+ for the corresponding DSA and return it.
+ """
+ for site in self.site_table.values():
+ dsa = site.get_dsa(dnstr)
+ if dsa is not None:
+ return dsa
+ return None
+
+ def modify_repsFrom(self, n_rep, t_repsFrom, s_rep, s_dsa, cn_conn):
+ """Update t_repsFrom if necessary to satisfy requirements. Such
+ updates are typically required when the IDL_DRSGetNCChanges
+ server has moved from one site to another--for example, to
+ enable compression when the server is moved from the
+ client's site to another site.
+ :param n_rep: NC replica we need
+ :param t_repsFrom: repsFrom tuple to modify
+ :param s_rep: NC replica at source DSA
+ :param s_dsa: source DSA
+ :param cn_conn: Local DSA NTDSConnection child
+ Returns (update) bit field containing which portion of the
+ repsFrom was modified. This bit field is suitable as input
+ to IDL_DRSReplicaModify ulModifyFields element, as it consists
+ of these bits:
+ drsuapi.DRSUAPI_DRS_UPDATE_SCHEDULE
+ drsuapi.DRSUAPI_DRS_UPDATE_FLAGS
+ drsuapi.DRSUAPI_DRS_UPDATE_ADDRESS
+ """
+ s_dnstr = s_dsa.dsa_dnstr
+ update = 0x0
+
+ if self.my_site.get_dsa(s_dnstr) is s_dsa:
+ same_site = True
+ else:
+ same_site = False
+
+ times = cn_conn.convert_schedule_to_repltimes()
+
+ # if schedule doesn't match then update and modify
+ if times != t_repsFrom.schedule:
+ t_repsFrom.schedule = times
+
+ # Bit DRS_PER_SYNC is set in replicaFlags if and only
+ # if nTDSConnection schedule has a value v that specifies
+ # scheduled replication is to be performed at least once
+ # per week.
+ if cn_conn.is_schedule_minimum_once_per_week():
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_PER_SYNC) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_PER_SYNC
+
+ # Bit DRS_INIT_SYNC is set in t.replicaFlags if and only
+ # if the source DSA and the local DC's nTDSDSA object are
+ # in the same site or source dsa is the FSMO role owner
+ # of one or more FSMO roles in the NC replica.
+ if same_site or n_rep.is_fsmo_role_owner(s_dnstr):
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_INIT_SYNC) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_INIT_SYNC
+
+ # If bit NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT is set in
+ # cn!options, bit DRS_NEVER_NOTIFY is set in t.replicaFlags
+ # if and only if bit NTDSCONN_OPT_USE_NOTIFY is clear in
+ # cn!options. Otherwise, bit DRS_NEVER_NOTIFY is set in
+ # t.replicaFlags if and only if s and the local DC's
+ # nTDSDSA object are in different sites.
+ if (cn_conn.options & dsdb.NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT) != 0x0:
+
+ if (cn_conn.option & dsdb.NTDSCONN_OPT_USE_NOTIFY) == 0x0:
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_NEVER_NOTIFY) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_NEVER_NOTIFY
+
+ elif same_site == False:
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_NEVER_NOTIFY) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_NEVER_NOTIFY
+
+ # Bit DRS_USE_COMPRESSION is set in t.replicaFlags if
+ # and only if s and the local DC's nTDSDSA object are
+ # not in the same site and the
+ # NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION bit is
+ # clear in cn!options
+ if same_site == False and \
+ (cn_conn.options & \
+ dsdb.NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION) == 0x0:
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_USE_COMPRESSION) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_USE_COMPRESSION
+
+ # Bit DRS_TWOWAY_SYNC is set in t.replicaFlags if and only
+ # if bit NTDSCONN_OPT_TWOWAY_SYNC is set in cn!options.
+ if (cn_conn.options & dsdb.NTDSCONN_OPT_TWOWAY_SYNC) != 0x0:
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_TWOWAY_SYNC) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_TWOWAY_SYNC
+
+ # Bits DRS_DISABLE_AUTO_SYNC and DRS_DISABLE_PERIODIC_SYNC are
+ # set in t.replicaFlags if and only if cn!enabledConnection = false.
+ if cn_conn.is_enabled() == False:
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_DISABLE_AUTO_SYNC) == 0x0:
+ t_repsFrom.replica_flags |= \
+ drsuapi.DRSUAPI_DRS_DISABLE_AUTO_SYNC
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_DISABLE_PERIODIC_SYNC) == 0x0:
+ t_repsFrom.replica_flags |= \
+ drsuapi.DRSUAPI_DRS_DISABLE_PERIODIC_SYNC
+
+ # If s and the local DC's nTDSDSA object are in the same site,
+ # cn!transportType has no value, or the RDN of cn!transportType
+ # is CN=IP:
+ #
+ # Bit DRS_MAIL_REP in t.replicaFlags is clear.
+ #
+ # t.uuidTransport = NULL GUID.
+ #
+ # t.uuidDsa = The GUID-based DNS name of s.
+ #
+ # Otherwise:
+ #
+ # Bit DRS_MAIL_REP in t.replicaFlags is set.
+ #
+ # If x is the object with dsname cn!transportType,
+ # t.uuidTransport = x!objectGUID.
+ #
+ # Let a be the attribute identified by
+ # x!transportAddressAttribute. If a is
+ # the dNSHostName attribute, t.uuidDsa = the GUID-based
+ # DNS name of s. Otherwise, t.uuidDsa = (s!parent)!a.
+ #
+ # It appears that the first statement i.e.
+ #
+ # "If s and the local DC's nTDSDSA object are in the same
+ # site, cn!transportType has no value, or the RDN of
+ # cn!transportType is CN=IP:"
+ #
+ # could be a slightly tighter statement if it had an "or"
+ # between each condition. I believe this should
+ # be interpreted as:
+ #
+ # IF (same-site) OR (no-value) OR (type-ip)
+ #
+ # because IP should be the primary transport mechanism
+ # (even in inter-site) and the absense of the transportType
+ # attribute should always imply IP no matter if its multi-site
+ #
+ # NOTE MS-TECH INCORRECT:
+ #
+ # All indications point to these statements above being
+ # incorrectly stated:
+ #
+ # t.uuidDsa = The GUID-based DNS name of s.
+ #
+ # Let a be the attribute identified by
+ # x!transportAddressAttribute. If a is
+ # the dNSHostName attribute, t.uuidDsa = the GUID-based
+ # DNS name of s. Otherwise, t.uuidDsa = (s!parent)!a.
+ #
+ # because the uuidDSA is a GUID and not a GUID-base DNS
+ # name. Nor can uuidDsa hold (s!parent)!a if not
+ # dNSHostName. What should have been said is:
+ #
+ # t.naDsa = The GUID-based DNS name of s
+ #
+ # That would also be correct if transportAddressAttribute
+ # were "mailAddress" because (naDsa) can also correctly
+ # hold the SMTP ISM service address.
+ #
+ nastr = "%s._msdcs.%s" % (s_dsa.dsa_guid, self.samdb.forest_dns_name())
+
+ # We're not currently supporting SMTP replication
+ # so is_smtp_replication_available() is currently
+ # always returning False
+ if same_site == True or \
+ cn_conn.transport_dnstr == None or \
+ cn_conn.transport_dnstr.find("CN=IP") == 0 or \
+ is_smtp_replication_available() == False:
+
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_MAIL_REP) != 0x0:
+ t_repsFrom.replica_flags &= ~drsuapi.DRSUAPI_DRS_MAIL_REP
+
+ null_guid = misc.GUID()
+ if t_repsFrom.transport_guid is None or \
+ t_repsFrom.transport_guid != null_guid:
+ t_repsFrom.transport_guid = null_guid
+
+ # See (NOTE MS-TECH INCORRECT) above
+ if t_repsFrom.version == 0x1:
+ if t_repsFrom.dns_name1 is None or \
+ t_repsFrom.dns_name1 != nastr:
+ t_repsFrom.dns_name1 = nastr
+ else:
+ if t_repsFrom.dns_name1 is None or \
+ t_repsFrom.dns_name2 is None or \
+ t_repsFrom.dns_name1 != nastr or \
+ t_repsFrom.dns_name2 != nastr:
+ t_repsFrom.dns_name1 = nastr
+ t_repsFrom.dns_name2 = nastr
+
+ else:
+ if (t_repsFrom.replica_flags & \
+ drsuapi.DRSUAPI_DRS_MAIL_REP) == 0x0:
+ t_repsFrom.replica_flags |= drsuapi.DRSUAPI_DRS_MAIL_REP
+
+ # We have a transport type but its not an
+ # object in the database
+ if cn_conn.transport_dnstr not in self.transport_table.keys():
+ raise Exception("Missing inter-site transport - (%s)" % \
+ cn_conn.transport_dnstr)
+
+ x_transport = self.transport_table[cn_conn.transport_dnstr]
+
+ if t_repsFrom.transport_guid != x_transport.guid:
+ t_repsFrom.transport_guid = x_transport.guid
+
+ # See (NOTE MS-TECH INCORRECT) above
+ if x_transport.addr_attr == "dNSHostName":
+
+ if t_repsFrom.version == 0x1:
+ if t_repsFrom.dns_name1 is None or \
+ t_repsFrom.dns_name1 != nastr:
+ t_repsFrom.dns_name1 = nastr
+ else:
+ if t_repsFrom.dns_name1 is None or \
+ t_repsFrom.dns_name2 is None or \
+ t_repsFrom.dns_name1 != nastr or \
+ t_repsFrom.dns_name2 != nastr:
+ t_repsFrom.dns_name1 = nastr
+ t_repsFrom.dns_name2 = nastr
+
+ else:
+ # MS tech specification says we retrieve the named
+ # attribute in "addr_attr" from the parent of the
+ # DSA object
+ try:
+ pdnstr = s_dsa.get_parent_dnstr()
+ attrs = [ x_transport.addr_attr ]
+
+ res = self.samdb.search(base=pdnstr, scope=ldb.SCOPE_BASE,
+ attrs=attrs)
+ except ldb.ldbError, (enum, estr):
+ raise Exception \
+ ("Unable to find attr (%s) for (%s) - (%s)" % \
+ (x_transport.addr_attr, pdnstr, estr))
+
+ msg = res[0]
+ nastr = str(msg[x_transport.addr_attr][0])
+
+ # See (NOTE MS-TECH INCORRECT) above
+ if t_repsFrom.version == 0x1:
+ if t_repsFrom.dns_name1 is None or \
+ t_repsFrom.dns_name1 != nastr:
+ t_repsFrom.dns_name1 = nastr
+ else:
+ if t_repsFrom.dns_name1 is None or \
+ t_repsFrom.dns_name2 is None or \
+ t_repsFrom.dns_name1 != nastr or \
+ t_repsFrom.dns_name2 != nastr:
+
+ t_repsFrom.dns_name1 = nastr
+ t_repsFrom.dns_name2 = nastr
+
+ if t_repsFrom.is_modified():
+ logger.debug("modify_repsFrom(): %s" % t_repsFrom)
+ return
+
+ def translate_ntdsconn(self):
+ """This function adjusts values of repsFrom abstract attributes of NC
+ replicas on the local DC to match those implied by
+ nTDSConnection objects.
+ """
+ logger.debug("translate_ntdsconn(): enter mydsa:\n%s" % self.my_dsa)
+
+ if self.my_dsa.should_translate_ntdsconn() == False:
+ return
+
+ current_rep_table, needed_rep_table = self.my_dsa.get_rep_tables()
+
+ # Filled in with replicas we currently have that need deleting
+ delete_rep_table = {}
+
+ # Table of replicas needed, combined with our local information
+ # if we already have the replica. This may be a superset list of
+ # replicas if we need additional NC replicas that we currently
+ # don't have local copies for
+ translate_rep_table = {}
+
+ # We're using the MS notation names here to allow
+ # correlation back to the published algorithm.
+ #
+ # n_rep - NC replica (n)
+ # t_repsFrom - tuple (t) in n!repsFrom
+ # s_dsa - Source DSA of the replica. Defined as nTDSDSA
+ # object (s) such that (s!objectGUID = t.uuidDsa)
+ # In our IDL representation of repsFrom the (uuidDsa)
+ # attribute is called (source_dsa_obj_guid)
+ # cn_conn - (cn) is nTDSConnection object and child of the local DC's
+ # nTDSDSA object and (cn!fromServer = s)
+ # s_rep - source DSA replica of n
+ #
+ # Build a list of replicas that we will run translation
+ # against. If we have the replica and its not needed
+ # then we add it to the "to be deleted" list. Otherwise
+ # we have it and we need it so move it to the translate list
+ for dnstr, n_rep in current_rep_table.items():
+ if dnstr not in needed_rep_table.keys():
+ delete_rep_table[dnstr] = n_rep
+ else:
+ translate_rep_table[dnstr] = n_rep
+
+ # If we need the replica yet we don't have it (not in
+ # translate list) then add it
+ for dnstr, n_rep in needed_rep_table.items():
+ if dnstr not in translate_rep_table.keys():
+ translate_rep_table[dnstr] = n_rep
+
+ # Now perform the scan of replicas we'll need
+ # and compare any current repsFrom against the
+ # connections
+ for dnstr, n_rep in translate_rep_table.items():
+
+ # load any repsFrom and fsmo roles as we'll
+ # need them during connection translation
+ n_rep.load_repsFrom(self.samdb)
+ n_rep.load_fsmo_roles(self.samdb)
+
+ # Loop thru the existing repsFrom tupples (if any)
+ for i, t_repsFrom in enumerate(n_rep.rep_repsFrom):
+
+ # for each tuple t in n!repsFrom, let s be the nTDSDSA
+ # object such that s!objectGUID = t.uuidDsa
+ guidstr = str(t_repsFrom.source_dsa_obj_guid)
+ s_dsa = self.get_dsa_by_guidstr(guidstr)
+
+ # Source dsa is gone from config (strange)
+ # so cleanup stale repsFrom for unlisted DSA
+ if s_dsa is None:
+ logger.debug("repsFrom source DSA guid (%s) not found" % \
+ guidstr)
+ t_repsFrom.to_be_deleted = True
+ continue
+
+ s_dnstr = s_dsa.dsa_dnstr
+
+ # Retrieve my DSAs connection object (if it exists)
+ # that specifies the fromServer equivalent to
+ # the DSA that is specified in the repsFrom source
+ cn_conn = self.my_dsa.get_connection_by_from_dnstr(s_dnstr)
+
+ # Let (cn) be the nTDSConnection object such that (cn)
+ # is a child of the local DC's nTDSDSA object and
+ # (cn!fromServer = s) and (cn!options) does not contain
+ # NTDSCONN_OPT_RODC_TOPOLOGY or NULL if no such (cn) exists.
+ if cn_conn and cn_conn.is_rodc_topology() == True:
+ cn_conn = None
+
+ # KCC removes this repsFrom tuple if any of the following
+ # is true:
+ # cn = NULL.
+ #
+ # No NC replica of the NC "is present" on DSA that
+ # would be source of replica
+ #
+ # A writable replica of the NC "should be present" on
+ # the local DC, but a partial replica "is present" on
+ # the source DSA
+ s_rep = s_dsa.get_current_replica(n_rep.nc_dnstr)
+
+ if cn_conn is None or \
+ s_rep is None or s_rep.is_present() == False or \
+ (n_rep.is_ro() == False and s_rep.is_partial() == True):
+
+ t_repsFrom.to_be_deleted = True
+ continue
+
+ # If the KCC did not remove t from n!repsFrom, it updates t
+ self.modify_repsFrom(n_rep, t_repsFrom, s_rep, s_dsa, cn_conn)
+
+ # Loop thru connections and add implied repsFrom tuples
+ # for each NTDSConnection under our local DSA if the
+ # repsFrom is not already present
+ for cn_dnstr, cn_conn in self.my_dsa.connect_table.items():
+
+ # NTDS Connection must satisfy all the following criteria
+ # to imply a repsFrom tuple is needed:
+ #
+ # cn!enabledConnection = true.
+ # cn!options does not contain NTDSCONN_OPT_RODC_TOPOLOGY.
+ # cn!fromServer references an nTDSDSA object.
+ s_dsa = None
+
+ if cn_conn.is_enabled() == True and \
+ cn_conn.is_rodc_topology() == False:
+
+ s_dnstr = cn_conn.get_from_dnstr()
+ if s_dnstr is not None:
+ s_dsa = self.get_dsa(s_dnstr)
+
+ if s_dsa == None:
+ continue
+
+ # Loop thru the existing repsFrom tupples (if any) and
+ # if we already have a tuple for this connection then
+ # no need to proceed to add. It will have been changed
+ # to have the correct attributes above
+ for i, t_repsFrom in enumerate(n_rep.rep_repsFrom):
+
+ guidstr = str(t_repsFrom.source_dsa_obj_guid)
+ if s_dsa is self.get_dsa_by_guidstr(guidstr):
+ s_dsa = None
+ break
+
+ if s_dsa == None:
+ continue
+
+ # Source dsa is gone from config (strange)
+ # To imply a repsFrom tuple is needed, each of these
+ # must be True:
+ #
+ # An NC replica of the NC "is present" on the DC to
+ # which the nTDSDSA object referenced by cn!fromServer
+ # corresponds.
+ #
+ # An NC replica of the NC "should be present" on
+ # the local DC
+ s_rep = s_dsa.get_current_replica(n_rep.nc_dnstr)
+
+ if s_rep is None or s_rep.is_present() == False:
+ continue
+
+ # To imply a repsFrom tuple is needed, each of these
+ # must be True:
+ #
+ # The NC replica on the DC referenced by cn!fromServer is
+ # a writable replica or the NC replica that "should be
+ # present" on the local DC is a partial replica.
+ #
+ # The NC is not a domain NC, the NC replica that
+ # "should be present" on the local DC is a partial
+ # replica, cn!transportType has no value, or
+ # cn!transportType has an RDN of CN=IP.
+ #
+ implies = (s_rep.is_ro() == False or \
+ n_rep.is_partial() == True) \
+ and \
+ (n_rep.is_domain() == False or\
+ n_rep.is_partial() == True or \
+ cn_conn.transport_dnstr == None or \
+ cn_conn.transport_dnstr.find("CN=IP") == 0)
+
+ if implies == False:
+ continue
+
+ # Create a new RepsFromTo and proceed to modify
+ # it according to specification
+ t_repsFrom = RepsFromTo(n_rep.nc_dnstr)
+
+ t_repsFrom.source_dsa_obj_guid = s_dsa.dsa_guid
+
+ self.modify_repsFrom(n_rep, t_repsFrom, s_rep, s_dsa, cn_conn)
+
+ # Add to our NC repsFrom as this is newly computed
+ if t_repsFrom.is_modified():
+ n_rep.rep_repsFrom.append(t_repsFrom)
+
+ # Commit any modified repsFrom to the NC replica
+ if opts.readonly is None:
+ n_rep.commit_repsFrom(self.samdb)
+
return
def intersite(self):
# partition (NC x) then continue
needed, ro, partial = nc_x.should_be_present(dc_local)
- logger.debug("construct_intrasite_graph:\n" + \
- "nc_x: %s\ndc_local: %s\n" % \
- (nc_x, dc_local) + \
- "gc_only: %s\nneeded: %s\nro: %s\npartial: %s" % \
- (gc_only, needed, ro, partial))
+ logger.debug("construct_intrasite_graph(): enter" + \
+ "\n\tgc_only=%d" % gc_only + \
+ "\n\tdetect_stale=%d" % detect_stale + \
+ "\n\tneeded=%s" % needed + \
+ "\n\tro=%s" % ro + \
+ "\n\tpartial=%s" % partial + \
+ "\n%s" % nc_x)
if needed == False:
return
l_of_x.rep_partial = partial
l_of_x.rep_ro = ro
+ # Add this replica that "should be present" to the
+ # needed replica table for this DSA
+ dc_local.add_needed_replica(l_of_x)
+
# Empty replica sequence list
r_list = []
# writeable NC replicas that match the naming
# context dn for (nc_x)
#
- for dc_s_dn, dc_s in self.dsa_table.items():
+ for dc_s_dn, dc_s in self.my_site.dsa_table.items():
# If this partition (nc_x) doesn't appear as a
# replica (f_of_x) on (dc_s) then continue
- if not nc_x.nc_dnstr in dc_s.rep_table.keys():
+ if not nc_x.nc_dnstr in dc_s.current_rep_table.keys():
continue
# Pull out the NCReplica (f) of (x) with the dn
# that matches NC (x) we are examining.
- f_of_x = dc_s.rep_table[nc_x.nc_dnstr]
+ f_of_x = dc_s.current_rep_table[nc_x.nc_dnstr]
# Replica (f) of NC (x) must be writable
if f_of_x.is_ro() == True:
continue
# DC (s) must be in the same site as the local DC
- # This is the intra-site algorithm. We are not
- # replicating across multiple sites
- if site_local.is_same_site(dc_s) == False:
- continue
+ # as this is the intra-site algorithm. This is
+ # handled by virtue of placing DSAs in per
+ # site objects (see enclosing for() loop)
# If NC (x) is intended to be read-only full replica
# for a domain NC on the target DC then the source
# Now we loop thru all the DSAs looking for
# partial NC replicas that match the naming
# context dn for (NC x)
- for dc_s_dn, dc_s in self.dsa_table.items():
+ for dc_s_dn, dc_s in self.my_site.dsa_table.items():
# If this partition NC (x) doesn't appear as a
# replica (p) of NC (x) on the dsa DC (s) then
# continue
- if not nc_x.nc_dnstr in dc_s.rep_table.keys():
+ if not nc_x.nc_dnstr in dc_s.current_rep_table.keys():
continue
# Pull out the NCReplica with the dn that
# matches NC (x) we are examining.
- p_of_x = dsa.rep_table[nc_x.nc_dnstr]
+ p_of_x = dsa.current_rep_table[nc_x.nc_dnstr]
# Replica (p) of NC (x) must be partial
if p_of_x.is_partial() == False:
continue
# DC (s) must be in the same site as the local DC
- # This is the intra-site algorithm. We are not
- # replicating across multiple sites
- if site_local.is_same_site(dc_s) == False:
- continue
+ # as this is the intra-site algorithm. This is
+ # handled by virtue of placing DSAs in per
+ # site objects (see enclosing for() loop)
# This criteria is moot (a no-op) for this case
# because we are scanning for (partial = True). The
# to ri is less than n+2, the KCC adds that edge to the graph.
i = 0
while i < r_len:
- dsa = self.dsa_table[graph_list[i].dsa_dnstr]
+ dsa = self.my_site.dsa_table[graph_list[i].dsa_dnstr]
graph_list[i].add_edges_from_connections(dsa)
i = i + 1
in the samdb
"""
# Retrieve my DSA
- mydsa = self.dsa_table[self.my_dsa_dnstr]
+ mydsa = self.my_dsa
- logger.debug("intrasite enter:\nmydsa: %s" % mydsa)
+ logger.debug("intrasite(): enter mydsa:\n%s" % mydsa)
# Test whether local site has topology disabled
mysite = self.site_table[self.my_site_dnstr]
False) # don't detect stale
# Commit any newly created connections to the samdb
- mydsa.commit_connection_table(self.samdb)
-
- logger.debug("intrasite exit:\nmydsa: %s" % mydsa)
+ if opts.readonly is None:
+ mydsa.commit_connection_table(self.samdb)
def run(self):
"""Method to perform a complete run of the KCC and
produce an updated topology for subsequent NC replica
syncronization between domain controllers
"""
- # Setup
try:
- self.load_my_dsa()
- self.load_all_dsa()
- self.load_all_partitions()
+ # Setup
self.load_my_site()
+ self.load_my_dsa()
- except Exception, estr:
- logger.error("%s" % estr)
- return
+ self.load_all_partitions()
+ self.load_all_transports()
- # self.should_be_present_test()
+ # These are the published steps (in order) for the
+ # MS-TECH description of the KCC algorithm
- # These are the published steps (in order) for the
- # MS description of the KCC algorithm
+ # Step 1
+ self.refresh_failed_links_connections()
- # Step 1
- self.refresh_failed_links_connections()
+ # Step 2
+ self.intrasite()
- # Step 2
- self.intrasite()
+ # Step 3
+ self.intersite()
- # Step 3
- self.intersite()
+ # Step 4
+ self.remove_unneeded_ntdsconn()
- # Step 4
- self.remove_unneeded_ntds_connections()
+ # Step 5
+ self.translate_ntdsconn()
- # Step 5
- self.translate_connections()
+ # Step 6
+ self.remove_unneeded_failed_links_connections()
- # Step 6
- self.remove_unneeded_failed_links_connections()
+ # Step 7
+ self.update_rodc_connection()
- # Step 7
- self.update_rodc_connection()
+ except Exception, estr:
+ logger.error("%s" % estr)
+ return 1
+ return 0
##################################################
# Global Functions
def sort_replica_by_dsa_guid(rep1, rep2):
return cmp(rep1.rep_dsa_guid, rep2.rep_dsa_guid)
+def is_smtp_replication_availalbe():
+ """Currently always returns false because Samba
+ doesn't implement SMTP transfer for NC changes
+ between DCs
+ """
+ return False
+
##################################################
# samba_kcc entry point
##################################################
parser.add_option_group(credopts)
parser.add_option_group(options.VersionOptions(parser))
-parser.add_option("--debug", help="debug output", action="store_true")
-parser.add_option("--seed", help="random number seed")
+parser.add_option("--readonly", \
+ help="compute topology but do not update database", \
+ action="store_true")
+parser.add_option("--debug", help="debug output", action="store_true")
+parser.add_option("--seed", help="random number seed")
logger = logging.getLogger("samba_kcc")
logger.addHandler(logging.StreamHandler(sys.stdout))
# Instantiate Knowledge Consistency Checker and perform run
kcc = KCC(samdb)
-kcc.run()
+rc = kcc.run()
+
+sys.exit(rc)
from samba import dsdb
from samba.dcerpc import misc
+from samba.dcerpc import drsblobs
+from samba.dcerpc import drsuapi
from samba.common import dsdb_Dn
+from samba.ndr import ndr_unpack
+from samba.ndr import ndr_pack
class NCType:
(unknown, schema, domain, config, application) = range(0, 5)
def __init__(self, nc_dnstr, nc_guid=None, nc_sid=None):
"""Instantiate a NamingContext
:param nc_dnstr: NC dn string
- :param nc_guid: NC guid string
+ :param nc_guid: NC guid
:param nc_sid: NC sid
"""
- self.nc_dnstr = nc_dnstr
- self.nc_guid = nc_guid
- self.nc_sid = nc_sid
- self.nc_type = NCType.unknown
+ self.nc_dnstr = nc_dnstr
+ self.nc_guid = nc_guid
+ self.nc_sid = nc_sid
+ self.nc_type = NCType.unknown
return
def __str__(self):
'''Debug dump string output of class'''
- return "%s:\n\tdn=%s\n\tguid=%s\n\ttype=%s" % \
- (self.__class__.__name__, self.nc_dnstr,
- self.nc_guid, self.nc_type)
+ text = "%s:" % self.__class__.__name__
+ text = text + "\n\tnc_dnstr=%s" % self.nc_dnstr
+ text = text + "\n\tnc_guid=%s" % str(self.nc_guid)
+ text = text + "\n\tnc_sid=%s" % self.nc_sid
+ text = text + "\n\tnc_type=%s" % self.nc_type
+
+ return text
def is_schema(self):
'''Return True if NC is schema'''
self.nc_type = NCType.schema
elif self.nc_dnstr == str(samdb.get_config_basedn()):
self.nc_type = NCType.config
- elif self.nc_sid != None:
+ elif self.nc_sid is not None:
self.nc_type = NCType.domain
else:
self.nc_type = NCType.application
return
-
class NCReplica(NamingContext):
"""Class defines a naming context replica that is relative
to a specific DSA. This is a more specific form of
"""Instantiate a Naming Context Replica
:param dsa_guid: GUID of DSA where replica appears
:param nc_dnstr: NC dn string
- :param nc_guid: NC guid string
+ :param nc_guid: NC guid
:param nc_sid: NC sid
"""
- self.rep_dsa_dnstr = dsa_dnstr
- self.rep_dsa_guid = dsa_guid # GUID of DSA where this appears
- self.rep_default = False # replica for DSA's default domain
- self.rep_partial = False
- self.rep_ro = False
- self.rep_flags = 0
+ self.rep_dsa_dnstr = dsa_dnstr
+ self.rep_dsa_guid = dsa_guid
+ self.rep_default = False # replica for DSA's default domain
+ self.rep_partial = False
+ self.rep_ro = False
+ self.rep_instantiated_flags = 0
+
+ # RepsFromTo tuples
+ self.rep_repsFrom = []
# The (is present) test is a combination of being
# enumerated in (hasMasterNCs or msDS-hasFullReplicaNCs or
def __str__(self):
'''Debug dump string output of class'''
- text = "default=%s" % self.rep_default + \
- ":ro=%s" % self.rep_ro + \
- ":partial=%s" % self.rep_partial + \
- ":present=%s" % self.is_present()
- return "%s\n\tdsaguid=%s\n\t%s" % \
- (NamingContext.__str__(self), self.rep_dsa_guid, text)
-
- def set_replica_flags(self, flags=None):
- '''Set or clear NC replica flags'''
+ text = "%s:" % self.__class__.__name__
+ text = text + "\n\tdsa_dnstr=%s" % self.rep_dsa_dnstr
+ text = text + "\n\tdsa_guid=%s" % str(self.rep_dsa_guid)
+ text = text + "\n\tdefault=%s" % self.rep_default
+ text = text + "\n\tro=%s" % self.rep_ro
+ text = text + "\n\tpartial=%s" % self.rep_partial
+ text = text + "\n\tpresent=%s" % self.is_present()
+
+ for rep in self.rep_repsFrom:
+ text = text + "\n%s" % rep
+
+ return "%s\n%s" % (NamingContext.__str__(self), text)
+
+ def set_instantiated_flags(self, flags=None):
+ '''Set or clear NC replica instantiated flags'''
if (flags == None):
- self.rep_flags = 0
+ self.rep_instantiated_flags = 0
else:
- self.rep_flags = flags
+ self.rep_instantiated_flags = flags
return
def identify_by_dsa_attr(self, samdb, attr):
set then the NC replica is not present (false)
"""
if self.rep_present_criteria_one and \
- self.rep_flags & dsdb.INSTANCE_TYPE_NC_GOING == 0:
+ self.rep_instantiated_flags & dsdb.INSTANCE_TYPE_NC_GOING == 0:
return True
return False
+ def load_repsFrom(self, samdb):
+ """Given an NC replica which has been discovered thru the nTDSDSA
+ database object, load the repsFrom attribute for the local replica.
+ held by my dsa. The repsFrom attribute is not replicated so this
+ attribute is relative only to the local DSA that the samdb exists on
+ """
+ try:
+ res = samdb.search(base=self.nc_dnstr, scope=ldb.SCOPE_BASE,
+ attrs=[ "repsFrom" ])
+
+ except ldb.LdbError, (enum, estr):
+ raise Exception("Unable to find NC for (%s) - (%s)" % \
+ (self.nc_dnstr, estr))
+ return
+
+ msg = res[0]
+
+ # Possibly no repsFrom if this is a singleton DC
+ if "repsFrom" in msg:
+ for value in msg["repsFrom"]:
+ rep = RepsFromTo(self.nc_dnstr, \
+ ndr_unpack(drsblobs.repsFromToBlob, value))
+ self.rep_repsFrom.append(rep)
+ return
+
+ def commit_repsFrom(self, samdb):
+ """Commit repsFrom to the database"""
+
+ # XXX - This is not truly correct according to the MS-TECH
+ # docs. To commit a repsFrom we should be using RPCs
+ # IDL_DRSReplicaAdd, IDL_DRSReplicaModify, and
+ # IDL_DRSReplicaDel to affect a repsFrom change.
+ #
+ # Those RPCs are missing in samba, so I'll have to
+ # implement them to get this to more accurately
+ # reflect the reference docs. As of right now this
+ # commit to the database will work as its what the
+ # older KCC also did
+ modify = False
+ newreps = []
+
+ for repsFrom in self.rep_repsFrom:
+
+ # Leave out any to be deleted from
+ # replacement list
+ if repsFrom.to_be_deleted == True:
+ modify = True
+ continue
+
+ if repsFrom.is_modified():
+ modify = True
+
+ newreps.append(ndr_pack(repsFrom.ndr_blob))
+
+ # Nothing to do if no reps have been modified or
+ # need to be deleted. Leave database record "as is"
+ if modify == False:
+ return
+
+ m = ldb.Message()
+ m.dn = ldb.Dn(samdb, self.nc_dnstr)
+
+ m["repsFrom"] = \
+ ldb.MessageElement(newreps, ldb.FLAG_MOD_REPLACE, "repsFrom")
+
+ try:
+ samdb.modify(m)
+
+ except ldb.LdbError, estr:
+ raise Exception("Could not set repsFrom for (%s) - (%s)" % \
+ (self.dsa_dnstr, estr))
+ return
+
+ def load_fsmo_roles(self, samdb):
+ # XXX - to be implemented
+ return
+
+ def is_fsmo_role_owner(self, dsa_dnstr):
+ # XXX - to be implemented
+ return False
class DirectoryServiceAgent:
self.dsa_guid = None
self.dsa_ivid = None
self.dsa_is_ro = False
- self.dsa_is_gc = False
+ self.dsa_options = 0
self.dsa_behavior = 0
self.default_dnstr = None # default domain dn string for dsa
- # NCReplicas for this dsa.
+ # NCReplicas for this dsa that are "present"
# Indexed by DN string of naming context
- self.rep_table = {}
+ self.current_rep_table = {}
- # NTDSConnections for this dsa.
- # Indexed by DN string of connection
+ # NCReplicas for this dsa that "should be present"
+ # Indexed by DN string of naming context
+ self.needed_rep_table = {}
+
+ # NTDSConnections for this dsa. These are current
+ # valid connections that are committed or "to be committed"
+ # in the database. Indexed by DN string of connection
self.connect_table = {}
+
return
def __str__(self):
'''Debug dump string output of class'''
- text = ""
- if self.dsa_dnstr:
- text = text + "\n\tdn=%s" % self.dsa_dnstr
- if self.dsa_guid:
- text = text + "\n\tguid=%s" % str(self.dsa_guid)
- if self.dsa_ivid:
- text = text + "\n\tivid=%s" % str(self.dsa_ivid)
-
- text = text + "\n\tro=%s:gc=%s" % (self.dsa_is_ro, self.dsa_is_gc)
- return "%s:%s\n%s\n%s" % (self.__class__.__name__, text,
- self.dumpstr_replica_table(),
- self.dumpstr_connect_table())
+
+ text = "%s:" % self.__class__.__name__
+ if self.dsa_dnstr is not None:
+ text = text + "\n\tdsa_dnstr=%s" % self.dsa_dnstr
+ if self.dsa_guid is not None:
+ text = text + "\n\tdsa_guid=%s" % str(self.dsa_guid)
+ if self.dsa_ivid is not None:
+ text = text + "\n\tdsa_ivid=%s" % str(self.dsa_ivid)
+
+ text = text + "\n\tro=%s" % self.is_ro()
+ text = text + "\n\tgc=%s" % self.is_gc()
+
+ text = text + "\ncurrent_replica_table:"
+ text = text + "\n%s" % self.dumpstr_current_replica_table()
+ text = text + "\nneeded_replica_table:"
+ text = text + "\n%s" % self.dumpstr_needed_replica_table()
+ text = text + "\nconnect_table:"
+ text = text + "\n%s" % self.dumpstr_connect_table()
+
+ return text
+
+ def get_current_replica(self, nc_dnstr):
+ return self.current_rep_table[nc_dnstr]
def is_ro(self):
'''Returns True if dsa a read only domain controller'''
def is_gc(self):
'''Returns True if dsa hosts a global catalog'''
- return self.dsa_is_gc
+ if (self.options & dsdb.DS_NTDSDSA_OPT_IS_GC) != 0:
+ return True
+ return False
def is_minimum_behavior(self, version):
"""Is dsa at minimum windows level greater than or
return True
return False
+ def should_translate_ntdsconn(self):
+ """Returns True if DSA object allows NTDSConnection
+ translation in its options. False otherwise.
+ """
+ if (self.options & dsdb.DS_NTDSDSA_OPT_DISABLE_NTDSCONN_XLATE) != 0:
+ return False
+ return True
+
+ def get_rep_tables(self):
+ """Return DSA current and needed replica tables
+ """
+ return self.current_rep_table, self.needed_rep_table
+
+ def get_parent_dnstr(self):
+ """Drop the leading portion of the DN string
+ (e.g. CN=NTDS Settings,) which will give us
+ the parent DN string of this object
+ """
+ head, sep, tail = self.dsa_dnstr.partition(',')
+ return tail
+
def load_dsa(self, samdb):
"""Method to load a DSA from the samdb. Prior initialization
has given us the DN of the DSA that we are to load. This
return
msg = res[0]
- self.dsa_guid = misc.GUID(samdb.schema_format_value("objectGUID",
+ self.dsa_guid = misc.GUID(samdb.schema_format_value("objectGUID", \
msg["objectGUID"][0]))
# RODCs don't originate changes and thus have no invocationId,
self.dsa_ivid = misc.GUID(samdb.schema_format_value("objectGUID",
msg["invocationId"][0]))
- if "options" in msg and \
- ((int(msg["options"][0]) & dsdb.DS_NTDSDSA_OPT_IS_GC) != 0):
- self.dsa_is_gc = True
- else:
- self.dsa_is_gc = False
+ if "options" in msg:
+ self.options = int(msg["options"][0])
if "msDS-isRODC" in msg and msg["msDS-isRODC"][0] == "TRUE":
self.dsa_is_ro = True
self.dsa_behavior = int(msg['msDS-Behavior-Version'][0])
# Load the NC replicas that are enumerated on this dsa
- self.load_replica_table(samdb)
+ self.load_current_replica_table(samdb)
# Load the nTDSConnection that are enumerated on this dsa
self.load_connection_table(samdb)
return
- def load_replica_table(self, samdb):
+ def load_current_replica_table(self, samdb):
"""Method to load the NC replica's listed for DSA object. This
method queries the samdb for (hasMasterNCs, msDS-hasMasterNCs,
hasPartialReplicaNCs, msDS-HasDomainNCs, msDS-hasFullReplicaNCs,
# not RODC - default, config, schema, app NCs
"msDS-hasMasterNCs",
# domain NC partial replicas
- "hasPartialReplicANCs",
+ "hasPartialReplicaNCs",
# default domain NC
"msDS-HasDomainNCs",
# RODC only - default, config, schema, app NCs
raise Exception("Missing GUID for (%s) - (%s: %s)" % \
(self.dsa_dnstr, k, value))
else:
- guidstr = str(misc.GUID(guid))
+ guid = misc.GUID(guid)
if not dnstr in tmp_table:
rep = NCReplica(self.dsa_dnstr, self.dsa_guid,
- dnstr, guidstr, sid)
+ dnstr, guid, sid)
tmp_table[dnstr] = rep
else:
rep = tmp_table[dnstr]
if k == "msDS-HasInstantiatedNCs":
- rep.set_replica_flags(flags)
+ rep.set_instantiated_flags(flags)
continue
rep.identify_by_dsa_attr(samdb, k)
return
# Assign our newly built NC replica table to this dsa
- self.rep_table = tmp_table
+ self.current_rep_table = tmp_table
+ return
+
+ def add_needed_replica(self, rep):
+ """Method to add a NC replica that "should be present" to the
+ needed_rep_table if not already in the table
+ """
+ if not rep.nc_dnstr in self.needed_rep_table.keys():
+ self.needed_rep_table[rep.nc_dnstr] = rep
+
return
def load_connection_table(self, samdb):
def commit_connection_table(self, samdb):
"""Method to commit any uncommitted nTDSConnections
- that are in our table. These would be newly identified
- connections that are marked as (committed = False)
+ that are in our table. These would be identified
+ connections that are marked to be added or deleted
:param samdb: database to commit DSA connection list to
"""
for dnstr, connect in self.connect_table.items():
connect.commit_connection(samdb)
- def add_connection_by_dnstr(self, dnstr, connect):
+ def add_connection(self, dnstr, connect):
self.connect_table[dnstr] = connect
return
return connect
return None
- def dumpstr_replica_table(self):
- '''Debug dump string output of replica table'''
+ def dumpstr_current_replica_table(self):
+ '''Debug dump string output of current replica table'''
+ text=""
+ for k in self.current_rep_table.keys():
+ if text:
+ text = text + "\n%s" % self.current_rep_table[k]
+ else:
+ text = "%s" % self.current_rep_table[k]
+ return text
+
+ def dumpstr_needed_replica_table(self):
+ '''Debug dump string output of needed replica table'''
text=""
- for k in self.rep_table.keys():
+ for k in self.needed_rep_table.keys():
if text:
- text = text + "\n%s" % self.rep_table[k]
+ text = text + "\n%s" % self.needed_rep_table[k]
else:
- text = "%s" % self.rep_table[k]
+ text = "%s" % self.needed_rep_table[k]
return text
def dumpstr_connect_table(self):
"""Class defines a nTDSConnection found under a DSA
"""
def __init__(self, dnstr):
- self.dnstr = dnstr
- self.enabled = False
- self.committed = False # appears in database
- self.options = 0
- self.flags = 0
- self.from_dnstr = None
- self.schedulestr = None
+ self.dnstr = dnstr
+ self.enabled = False
+ self.committed = False # new connection needs to be committed
+ self.options = 0
+ self.flags = 0
+ self.transport_dnstr = None
+ self.transport_guid = None
+ self.from_dnstr = None
+ self.from_guid = None
+ self.schedule = None
return
def __str__(self):
'''Debug dump string output of NTDSConnection object'''
- text = "%s: %s" % (self.__class__.__name__, self.dnstr)
- text = text + "\n\tenabled: %s" % self.enabled
- text = text + "\n\tcommitted: %s" % self.committed
- text = text + "\n\toptions: 0x%08X" % self.options
- text = text + "\n\tflags: 0x%08X" % self.flags
- text = text + "\n\tfrom_dn: %s" % self.from_dnstr
+
+ text = "%s:\n\tdn=%s" % (self.__class__.__name__, self.dnstr)
+ text = text + "\n\tenabled=%s" % self.enabled
+ text = text + "\n\tcommitted=%s" % self.committed
+ text = text + "\n\toptions=0x%08X" % self.options
+ text = text + "\n\tflags=0x%08X" % self.flags
+ text = text + "\n\ttransport_dn=%s" % self.transport_dnstr
+
+ if self.transport_guid is not None:
+ text = text + "\n\ttransport_guid=%s" % str(self.transport_guid)
+
+ text = text + "\n\tfrom_dn=%s" % self.from_dnstr
+ text = text + "\n\tfrom_guid=%s" % str(self.from_guid)
+
+ if self.schedule is not None:
+ text = text + "\n\tschedule.size=%s" % self.schedule.size
+ text = text + "\n\tschedule.bandwidth=%s" % self.schedule.bandwidth
+ text = text + "\n\tschedule.numberOfSchedules=%s" % \
+ self.schedule.numberOfSchedules
+
+ for i, header in enumerate(self.schedule.headerArray):
+ text = text + "\n\tschedule.headerArray[%d].type=%d" % \
+ (i, header.type)
+ text = text + "\n\tschedule.headerArray[%d].offset=%d" % \
+ (i, header.offset)
+ text = text + "\n\tschedule.dataArray[%d].slots[ " % i
+ for slot in self.schedule.dataArray[i].slots:
+ text = text + "0x%X " % slot
+ text = text + "]"
+
return text
def load_connection(self, samdb):
from the samdb.
Raises an Exception on error.
"""
+ controls = ["extended_dn:1:1"]
attrs = [ "options",
"enabledConnection",
"schedule",
+ "transportType",
"fromServer",
"systemFlags" ]
try:
res = samdb.search(base=self.dnstr, scope=ldb.SCOPE_BASE,
- attrs=attrs)
+ attrs=attrs, controls=controls)
except ldb.LdbError, (enum, estr):
raise Exception("Unable to find nTDSConnection for (%s) - (%s)" % \
self.enabled = True
if "systemFlags" in msg:
self.flags = int(msg["systemFlags"][0])
+ if "transportType" in msg:
+ dsdn = dsdb_Dn(samdb, msg["tranportType"][0])
+ guid = dsdn.dn.get_extended_component('GUID')
+
+ assert guid is not None
+ self.transport_guid = misc.GUID(guid)
+
+ self.transport_dnstr = str(dsdn.dn)
+ assert self.transport_dnstr is not None
+
if "schedule" in msg:
- self.schedulestr = msg["schedule"][0]
+ self.schedule = ndr_unpack(drsblobs.replSchedule, msg["schedule"][0])
+
if "fromServer" in msg:
dsdn = dsdb_Dn(samdb, msg["fromServer"][0])
+ guid = dsdn.dn.get_extended_component('GUID')
+
+ assert guid is not None
+ self.from_guid = misc.GUID(guid)
+
self.from_dnstr = str(dsdn.dn)
- assert self.from_dnstr != None
+ assert self.from_dnstr is not None
- # Appears as committed in the database
+ # Was loaded from database so connection is currently committed
self.committed = True
return
"""Given a NTDSConnection object that is not committed in the
sam database, perform a commit action.
"""
- if self.committed: # nothing to do
+ # nothing to do
+ if self.committed == True:
return
- # XXX - not yet written
+ # First verify we don't have this entry to ensure nothing
+ # is programatically amiss
+ try:
+ msg = samdb.search(base=self.dnstr, scope=ldb.SCOPE_BASE)
+ found = True
+
+ except ldb.LdbError, (enum, estr):
+ if enum == ldb.ERR_NO_SUCH_OBJECT:
+ found = False
+ else:
+ raise Exception("Unable to search for (%s) - (%s)" % \
+ (self.dnstr, estr))
+ if found:
+ raise Exception("nTDSConnection for (%s) already exists!" % self.dnstr)
+
+ if self.enabled:
+ enablestr = "TRUE"
+ else:
+ enablestr = "FALSE"
+
+ # Prepare a message for adding to the samdb
+ m = ldb.Message()
+ m.dn = ldb.Dn(samdb, self.dnstr)
+
+ m["objectClass"] = \
+ ldb.MessageElement("nTDSConnection", ldb.FLAG_MOD_ADD, \
+ "objectClass")
+ m["showInAdvancedViewOnly"] = \
+ ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, \
+ "showInAdvancedViewOnly")
+ m["enabledConnection"] = \
+ ldb.MessageElement(enablestr, ldb.FLAG_MOD_ADD, "enabledConnection")
+ m["fromServer"] = \
+ ldb.MessageElement(self.from_dnstr, ldb.FLAG_MOD_ADD, "fromServer")
+ m["options"] = \
+ ldb.MessageElement(str(self.options), ldb.FLAG_MOD_ADD, "options")
+ m["systemFlags"] = \
+ ldb.MessageElement(str(self.flags), ldb.FLAG_MOD_ADD, "systemFlags")
+
+ if self.schedule is not None:
+ m["schedule"] = \
+ ldb.MessageElement(ndr_pack(self.schedule),
+ ldb.FLAG_MOD_ADD, "schedule")
+ try:
+ samdb.add(m)
+ except ldb.LdbError, (enum, estr):
+ raise Exception("Could not add nTDSConnection for (%s) - (%s)" % \
+ (self.dnstr, estr))
+ self.committed = True
return
+ def is_schedule_minimum_once_per_week(self):
+ """Returns True if our schedule includes at least one
+ replication interval within the week. False otherwise
+ """
+ if self.schedule is None or self.schedule.dataArray[0] is None:
+ return False
+
+ for slot in self.schedule.dataArray[0].slots:
+ if (slot & 0x0F) != 0x0:
+ return True
+ return False
+
+ def convert_schedule_to_repltimes(self):
+ """Convert NTDS Connection schedule to replTime schedule.
+ NTDS Connection schedule slots are double the size of
+ the replTime slots but the top portion of the NTDS
+ Connection schedule slot (4 most significant bits in
+ uchar) are unused. The 4 least significant bits have
+ the same (15 minute interval) bit positions as replTimes.
+ We thus pack two elements of the NTDS Connection schedule
+ slots into one element of the replTimes slot
+ If no schedule appears in NTDS Connection then a default
+ of 0x11 is set in each replTimes slot as per behaviour
+ noted in a Windows DC. That default would cause replication
+ within the last 15 minutes of each hour.
+ """
+ times = [0x11] * 84
+
+ for i, slot in enumerate(times):
+ if self.schedule is not None and \
+ self.schedule.dataArray[0] is not None:
+ slot = (self.schedule.dataArray[0].slots[i*2] & 0xF) << 4 | \
+ (self.schedule.dataArray[0].slots[i*2] & 0xF)
+ return times
+
+ def is_rodc_topology(self):
+ """Returns True if NTDS Connection specifies RODC
+ topology only
+ """
+ if self.options & dsdb.NTDSCONN_OPT_RODC_TOPOLOGY == 0:
+ return False
+ return True
+
+ def is_enabled(self):
+ """Returns True if NTDS Connection is enabled
+ """
+ return self.enabled
+
def get_from_dnstr(self):
'''Return fromServer dn string attribute'''
return self.from_dnstr
raise Exception("Missing GUID for (%s) - (%s: %s)" % \
(self.partstr, k, value))
else:
- guidstr = str(misc.GUID(guid))
+ guid = misc.GUID(guid)
if k == "nCName":
self.nc_dnstr = str(dsdn.dn)
- self.nc_guid = guidstr
+ self.nc_guid = guid
self.nc_sid = sid
continue
def __init__(self, site_dnstr):
self.site_dnstr = site_dnstr
self.site_options = 0
+ self.dsa_table = {}
return
def load_site(self, samdb):
msg = res[0]
if "options" in msg:
self.site_options = int(msg["options"][0])
+
+ self.load_all_dsa(samdb)
return
- def is_same_site(self, target_dsa):
- '''Determine if target dsa is in this site'''
- if self.site_dnstr in target_dsa.dsa_dnstr:
- return True
- return False
+ def load_all_dsa(self, samdb):
+ """Discover all nTDSDSA thru the sites entry and
+ instantiate and load the DSAs. Each dsa is inserted
+ into the dsa_table by dn string.
+ Raises an Exception on error.
+ """
+ try:
+ res = samdb.search(self.site_dnstr,
+ scope=ldb.SCOPE_SUBTREE,
+ expression="(objectClass=nTDSDSA)")
+ except ldb.LdbError, (enum, estr):
+ raise Exception("Unable to find nTDSDSAs - (%s)" % estr)
+
+ for msg in res:
+ dnstr = str(msg.dn)
+
+ # already loaded
+ if dnstr in self.dsa_table.keys():
+ continue
+
+ dsa = DirectoryServiceAgent(dnstr)
+
+ dsa.load_dsa(samdb)
+
+ # Assign this dsa to my dsa table
+ # and index by dsa dn
+ self.dsa_table[dnstr] = dsa
+ return
+
+ def get_dsa_by_guidstr(self, guidstr):
+ for dsa in self.dsa_table.values():
+ if str(dsa.dsa_guid) == guidstr:
+ return dsa
+ return None
+
+ def get_dsa(self, dnstr):
+ """Return a previously loaded DSA object by consulting
+ the sites dsa_table for the provided DSA dn string
+ Returns None if DSA doesn't exist
+ """
+ if dnstr in self.dsa_table.keys():
+ return self.dsa_table[dnstr]
+ return None
def is_intrasite_topology_disabled(self):
'''Returns True if intrasite topology is disabled for site'''
return True
return False
+ def __str__(self):
+ '''Debug dump string output of class'''
+ text = "%s:" % self.__class__.__name__
+ text = text + "\n\tdn=%s" % self.site_dnstr
+ text = text + "\n\toptions=0x%X" % self.site_options
+ for key, dsa in self.dsa_table.items():
+ text = text + "\n%s" % dsa
+ return text
+
class GraphNode:
"""This is a graph node describing a set of edges that should be
self.edge_from = []
def __str__(self):
- text = "%s: %s" % (self.__class__.__name__, self.dsa_dnstr)
- for edge in self.edge_from:
- text = text + "\n\tedge from: %s" % edge
+ text = "%s:" % self.__class__.__name__
+ text = text + "\n\tdsa_dnstr=%s" % self.dsa_dnstr
+ text = text + "\n\tmax_edges=%d" % self.max_edges
+
+ for i, edge in enumerate(self.edge_from):
+ text = text + "\n\tedge_from[%d]=%s" % (i, edge)
return text
def add_edge_from(self, from_dsa_dnstr):
"""Add an edge from the dsa to our graph nodes edge from list
:param from_dsa_dnstr: the dsa that the edge emanates from
"""
- assert from_dsa_dnstr != None
+ assert from_dsa_dnstr is not None
# No edges from myself to myself
if from_dsa_dnstr == self.dsa_dnstr:
# the DC on which ri "is present".
#
# c.options does not contain NTDSCONN_OPT_RODC_TOPOLOGY
- if connect and \
- connect.options & dsdb.NTDSCONN_OPT_RODC_TOPOLOGY == 0:
+ if connect and connect.is_rodc_topology() == False:
exists = True
else:
exists = False
dnstr = "CN=%s," % str(uuid.uuid4()) + self.dsa_dnstr
connect = NTDSConnection(dnstr)
- connect.enabled = True
- connect.committed = False
- connect.from_dnstr = edge_dnstr
- connect.options = dsdb.NTDSCONN_OPT_IS_GENERATED
- connect.flags = dsdb.SYSTEM_FLAG_CONFIG_ALLOW_RENAME + \
- dsdb.SYSTEM_FLAG_CONFIG_ALLOW_MOVE
+ connect.committed = False
+ connect.enabled = True
+ connect.from_dnstr = edge_dnstr
+ connect.options = dsdb.NTDSCONN_OPT_IS_GENERATED
+ connect.flags = dsdb.SYSTEM_FLAG_CONFIG_ALLOW_RENAME + \
+ dsdb.SYSTEM_FLAG_CONFIG_ALLOW_MOVE
+
+ # Create schedule. Attribute valuse set according to MS-TECH
+ # intrasite connection creation document
+ connect.schedule = drsblobs.schedule()
+
+ connect.schedule.size = 188
+ connect.schedule.bandwidth = 0
+ connect.schedule.numberOfSchedules = 1
- # XXX I need to write the schedule blob
+ header = drsblobs.scheduleHeader()
+ header.type = 0
+ header.offset = 20
- dsa.add_connection_by_dnstr(dnstr, connect);
+ connect.schedule.headerArray = [ header ]
+
+ # 168 byte instances of the 0x01 value. The low order 4 bits
+ # of the byte equate to 15 minute intervals within a single hour.
+ # There are 168 bytes because there are 168 hours in a full week
+ # Effectively we are saying to perform replication at the end of
+ # each hour of the week
+ data = drsblobs.scheduleSlots()
+ data.slots = [ 0x01 ] * 168
+
+ connect.schedule.dataArray = [ data ]
+
+ dsa.add_connection(dnstr, connect);
return
if len(self.edge_from) >= self.max_edges:
return True
return False
+
+class Transport():
+ """Class defines a Inter-site transport found under Sites
+ """
+ def __init__(self, dnstr):
+ self.dnstr = dnstr
+ self.options = 0
+ self.guid = None
+ self.address_attr = None
+ return
+
+ def __str__(self):
+ '''Debug dump string output of Transport object'''
+
+ text = "%s:\n\tdn=%s" % (self.__class__.__name__, self.dnstr)
+ text = text + "\n\tguid=%s" % str(self.guid)
+ text = text + "\n\toptions=%d" % self.options
+ text = text + "\n\taddress_attr=%s" % self.address_attr
+
+ return text
+
+ def load_transport(self, samdb):
+ """Given a Transport object with an prior initialization
+ for the object's DN, search for the DN and load attributes
+ from the samdb.
+ Raises an Exception on error.
+ """
+ attrs = [ "objectGUID",
+ "options",
+ "transportAddressAttribute" ]
+ try:
+ res = samdb.search(base=self.dnstr, scope=ldb.SCOPE_BASE,
+ attrs=attrs)
+
+ except ldb.LdbError, (enum, estr):
+ raise Exception("Unable to find Transport for (%s) - (%s)" % \
+ (self.dnstr, estr))
+ return
+
+ msg = res[0]
+ self.guid = misc.GUID(samdb.schema_format_value("objectGUID",
+ msg["objectGUID"][0]))
+
+ if "options" in msg:
+ self.options = int(msg["options"][0])
+ if "transportAddressAttribute" in msg:
+ self.address_attr = str(msg["transportAddressAttribute"][0])
+
+ return
+
+class RepsFromTo:
+ """Class encapsulation of the NDR repsFromToBlob.
+ Removes the necessity of external code having to
+ understand about other_info or manipulation of
+ update flags.
+ """
+ def __init__(self, nc_dnstr=None, ndr_blob=None):
+
+ self.__dict__['to_be_deleted'] = False
+ self.__dict__['nc_dnstr'] = nc_dnstr
+ self.__dict__['update_flags'] = 0x0
+
+ # WARNING:
+ #
+ # There is a very subtle bug here with python
+ # and our NDR code. If you assign directly to
+ # a NDR produced struct (e.g. t_repsFrom.ctr.other_info)
+ # then a proper python GC reference count is not
+ # maintained.
+ #
+ # To work around this we maintain an internal
+ # reference to "dns_name(x)" and "other_info" elements
+ # of repsFromToBlob. This internal reference
+ # is hidden within this class but it is why you
+ # see statements like this below:
+ #
+ # self.__dict__['ndr_blob'].ctr.other_info = \
+ # self.__dict__['other_info'] = drsblobs.repsFromTo1OtherInfo()
+ #
+ # That would appear to be a redundant assignment but
+ # it is necessary to hold a proper python GC reference
+ # count.
+ if ndr_blob is None:
+ self.__dict__['ndr_blob'] = drsblobs.repsFromToBlob()
+ self.__dict__['ndr_blob'].version = 0x1
+ self.__dict__['dns_name1'] = None
+ self.__dict__['dns_name2'] = None
+
+ self.__dict__['ndr_blob'].ctr.other_info = \
+ self.__dict__['other_info'] = drsblobs.repsFromTo1OtherInfo()
+
+ else:
+ self.__dict__['ndr_blob'] = ndr_blob
+ self.__dict__['other_info'] = ndr_blob.ctr.other_info
+
+ if ndr_blob.version == 0x1:
+ self.__dict__['dns_name1'] = ndr_blob.ctr.other_info.dns_name
+ self.__dict__['dns_name2'] = None
+ else:
+ self.__dict__['dns_name1'] = ndr_blob.ctr.other_info.dns_name1
+ self.__dict__['dns_name2'] = ndr_blob.ctr.other_info.dns_name2
+ return
+
+ def __str__(self):
+ '''Debug dump string output of class'''
+
+ text = "%s:" % self.__class__.__name__
+ text = text + "\n\tdnstr=%s" % self.nc_dnstr
+ text = text + "\n\tupdate_flags=0x%X" % self.update_flags
+
+ text = text + "\n\tversion=%d" % self.version
+ text = text + "\n\tsource_dsa_obj_guid=%s" % \
+ str(self.source_dsa_obj_guid)
+ text = text + "\n\tsource_dsa_invocation_id=%s" % \
+ str(self.source_dsa_invocation_id)
+ text = text + "\n\ttransport_guid=%s" % \
+ str(self.transport_guid)
+ text = text + "\n\treplica_flags=0x%X" % \
+ self.replica_flags
+ text = text + "\n\tconsecutive_sync_failures=%d" % \
+ self.consecutive_sync_failures
+ text = text + "\n\tlast_success=%s" % \
+ self.last_success
+ text = text + "\n\tlast_attempt=%s" % \
+ self.last_attempt
+ text = text + "\n\tdns_name1=%s" % \
+ str(self.dns_name1)
+ text = text + "\n\tdns_name2=%s" % \
+ str(self.dns_name2)
+ text = text + "\n\tschedule[ "
+ for slot in self.schedule:
+ text = text + "0x%X " % slot
+ text = text + "]"
+
+ return text
+
+ def __setattr__(self, item, value):
+
+ if item in [ 'schedule', 'replica_flags', 'transport_guid', \
+ 'source_dsa_obj_guid', 'source_dsa_invocation_id', \
+ 'consecutive_sync_failures', 'last_success', \
+ 'last_attempt' ]:
+ setattr(self.__dict__['ndr_blob'].ctr, item, value)
+
+ elif item in ['dns_name1']:
+ self.__dict__['dns_name1'] = value
+
+ if self.__dict__['ndr_blob'].version == 0x1:
+ self.__dict__['ndr_blob'].ctr.other_info.dns_name = \
+ self.__dict__['dns_name1']
+ else:
+ self.__dict__['ndr_blob'].ctr.other_info.dns_name1 = \
+ self.__dict__['dns_name1']
+
+ elif item in ['dns_name2']:
+ self.__dict__['dns_name2'] = value
+
+ if self.__dict__['ndr_blob'].version == 0x1:
+ raise AttributeError(item)
+ else:
+ self.__dict__['ndr_blob'].ctr.other_info.dns_name2 = \
+ self.__dict__['dns_name2']
+
+ elif item in ['version']:
+ raise AttributeError, "Attempt to set readonly attribute %s" % item
+ else:
+ raise AttributeError, "Unknown attribute %s" % item
+
+ if item in ['replica_flags']:
+ self.__dict__['update_flags'] |= drsuapi.DRSUAPI_DRS_UPDATE_FLAGS
+ elif item in ['schedule']:
+ self.__dict__['update_flags'] |= drsuapi.DRSUAPI_DRS_UPDATE_SCHEDULE
+ else:
+ self.__dict__['update_flags'] |= drsuapi.DRSUAPI_DRS_UPDATE_ADDRESS
+
+ return
+
+ def __getattr__(self, item):
+ """Overload of RepsFromTo attribute retrieval. Allows
+ external code to ignore substructures within the blob
+ """
+ if item in [ 'schedule', 'replica_flags', 'transport_guid', \
+ 'source_dsa_obj_guid', 'source_dsa_invocation_id', \
+ 'consecutive_sync_failures', 'last_success', \
+ 'last_attempt' ]:
+ return getattr(self.__dict__['ndr_blob'].ctr, item)
+
+ elif item in ['version']:
+ return self.__dict__['ndr_blob'].version
+
+ elif item in ['dns_name1']:
+ if self.__dict__['ndr_blob'].version == 0x1:
+ return self.__dict__['ndr_blob'].ctr.other_info.dns_name
+ else:
+ return self.__dict__['ndr_blob'].ctr.other_info.dns_name1
+
+ elif item in ['dns_name2']:
+ if self.__dict__['ndr_blob'].version == 0x1:
+ raise AttributeError(item)
+ else:
+ return self.__dict__['ndr_blob'].ctr.other_info.dns_name2
+
+ raise AttributeError, "Unknwown attribute %s" % item
+
+ def is_modified(self):
+ return (self.update_flags != 0x0)
git.samba.org / samba.git / commitdiff