python/samba/schema.py

   1 #
   2 # Unix SMB/CIFS implementation.
   3 # backend code for provisioning a Samba4 server
   4 #
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
   7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 """Functions for setting up a Samba Schema."""
  24
  25 from base64 import b64encode
  26 from samba import read_and_sub_file, substitute_var, check_all_substituted
  27 from samba.dcerpc import security
  28 from samba.ms_schema import read_ms_schema
  29 from samba.ndr import ndr_pack
  30 from samba.samdb import SamDB
  31 from samba.common import get_string
  32 from samba import dsdb
  33 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL
  34
  35
  36 def get_schema_descriptor(domain_sid, name_map=None):
  37     if name_map is None:
  38         name_map = {}
  39
  40     sddl = "O:SAG:SAD:AI(OA;;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;SA)" \
  41            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
  42            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
  43            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
  44            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
  45            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
  46            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
  47            "(A;CI;RPLCLORC;;;AU)" \
  48            "(A;CI;RPWPCRCCLCLORCWOWDSW;;;SA)" \
  49            "(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)" \
  50            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
  51            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
  52            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
  53            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
  54            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;RO)" \
  55            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;RO)" \
  56            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;RO)" \
  57            "S:(AU;SA;WPCCDCWOWDSDDTSW;;;WD)" \
  58            "(AU;CISA;WP;;;WD)" \
  59            "(AU;SA;CR;;;BA)" \
  60            "(AU;SA;CR;;;DU)" \
  61            "(OU;SA;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;WD)" \
  62            "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
  63     sec = security.descriptor.from_sddl(sddl, domain_sid)
  64     return ndr_pack(sec)
  65
  66
  67 class Schema(object):
  68
  69     # the schema files (and corresponding object version) that we know about
  70     base_schemas = {
  71         "2008_R2_old": ("MS-AD_Schema_2K8_R2_Attributes.txt",
  72                         "MS-AD_Schema_2K8_R2_Classes.txt",
  73                         47),
  74        "2008_R2": ("Attributes_for_AD_DS__Windows_Server_2008_R2.ldf",
  75                    "Classes_for_AD_DS__Windows_Server_2008_R2.ldf",
  76                    47),
  77        "2012": ("Attributes_for_AD_DS__Windows_Server_2012.ldf",
  78                 "Classes_for_AD_DS__Windows_Server_2012.ldf",
  79                 56),
  80        "2012_R2": ("AD_DS_Attributes__Windows_Server_2012_R2.ldf",
  81                    "AD_DS_Classes__Windows_Server_2012_R2.ldf",
  82                    69),
  83        "2016": ("AD_DS_Attributes__Windows_Server_v1803.ldf",
  84                 "AD_DS_Classes__Windows_Server_v1803.ldf",
  85                 87),
  86        "2019": ("AD_DS_Attributes_Windows_Server_v1903.ldf",
  87                 "AD_DS_Classes_Windows_Server_v1903.ldf",
  88                 88),
  89     }
  90
  91     def __init__(self, domain_sid, invocationid=None, schemadn=None,
  92                  files=None, override_prefixmap=None, additional_prefixmap=None,
  93                  base_schema=None):
  94         from samba.provision import setup_path
  95
  96         """Load schema for the SamDB from the AD schema files and
  97         samba4_schema.ldif
  98
  99         :param samdb: Load a schema into a SamDB.
 100         :param schemadn: DN of the schema
 101
 102         Returns the schema data loaded, to avoid double-parsing when then
 103         needing to add it to the db
 104         """
 105
 106         if base_schema is None:
 107             base_schema = Schema.default_base_schema()
 108
 109         self.base_schema = base_schema
 110
 111         self.schemadn = schemadn
 112         # We need to have the am_rodc=False just to keep some warnings quiet -
 113         # this isn't a real SAM, so it's meaningless.
 114         self.ldb = SamDB(global_schema=False, am_rodc=False)
 115         if invocationid is not None:
 116             self.ldb.set_invocation_id(invocationid)
 117
 118         self.schema_data = read_ms_schema(
 119             setup_path('ad-schema/%s' % Schema.base_schemas[base_schema][0]),
 120             setup_path('ad-schema/%s' % Schema.base_schemas[base_schema][1]))
 121
 122         def read_file(file):
 123             with open(file, 'rb') as data_file:
 124                 return data_file.read()
 125
 126         if files is not None:
 127             self.schema_data = "".join(get_string(read_file(file))
 128                                        for file in files)
 129
 130         self.schema_data = substitute_var(self.schema_data,
 131                                           {"SCHEMADN": schemadn})
 132         check_all_substituted(self.schema_data)
 133
 134         schema_version = str(Schema.get_version(base_schema))
 135         self.schema_dn_modify = read_and_sub_file(
 136             setup_path("provision_schema_basedn_modify.ldif"),
 137             {"SCHEMADN": schemadn, "OBJVERSION": schema_version})
 138
 139         descr = b64encode(get_schema_descriptor(domain_sid)).decode('utf8')
 140         self.schema_dn_add = read_and_sub_file(
 141             setup_path("provision_schema_basedn.ldif"),
 142             {"SCHEMADN": schemadn, "DESCRIPTOR": descr})
 143
 144         if override_prefixmap is not None:
 145             self.prefixmap_data = override_prefixmap
 146         else:
 147             self.prefixmap_data = read_file(setup_path("prefixMap.txt"))
 148
 149         if additional_prefixmap is not None:
 150             self.prefixmap_data += "".join("%s\n" % map for map in additional_prefixmap)
 151
 152         self.prefixmap_data = b64encode(self.prefixmap_data).decode('utf8')
 153
 154         # We don't actually add this ldif, just parse it
 155         prefixmap_ldif = "dn: %s\nprefixMap:: %s\n\n" % (self.schemadn, self.prefixmap_data)
 156         self.set_from_ldif(prefixmap_ldif, self.schema_data, self.schemadn)
 157
 158     @staticmethod
 159     def default_base_schema():
 160         """Returns the default base schema to use"""
 161         return "2012_R2"
 162
 163     @staticmethod
 164     def get_version(base_schema):
 165         """Returns the base schema's object version, e.g. 47 for 2008_R2"""
 166         return Schema.base_schemas[base_schema][2]
 167
 168     def set_from_ldif(self, pf, df, dn):
 169         dsdb._dsdb_set_schema_from_ldif(self.ldb, pf, df, dn)
 170
 171     def write_to_tmp_ldb(self, schemadb_path):
 172         self.ldb.connect(url=schemadb_path)
 173         self.ldb.transaction_start()
 174         try:
 175             # These are actually ignored, as the schema has been forced
 176             # when the ldb object was created, and that overrides this
 177             self.ldb.add_ldif("""dn: @ATTRIBUTES
 178 linkID: INTEGER
 179
 180 dn: @INDEXLIST
 181 @IDXATTR: linkID
 182 @IDXATTR: attributeSyntax
 183 @IDXGUID: objectGUID
 184 """)
 185
 186             schema_dn_add = self.schema_dn_add \
 187                 + "objectGUID: 24e2ca70-b093-4ae8-84c0-2d7ac652a1b8\n"
 188
 189             # These bits of LDIF are supplied when the Schema object is created
 190             self.ldb.add_ldif(schema_dn_add)
 191             self.ldb.modify_ldif(self.schema_dn_modify)
 192             self.ldb.add_ldif(self.schema_data)
 193         except:
 194             self.ldb.transaction_cancel()
 195             raise
 196         else:
 197             self.ldb.transaction_commit()
 198
 199     # Return a hash with the forward attribute as a key and the back as the
 200     # value
 201     def linked_attributes(self):
 202         return get_linked_attributes(self.schemadn, self.ldb)
 203
 204     def dnsyntax_attributes(self):
 205         return get_dnsyntax_attributes(self.schemadn, self.ldb)
 206
 207     def convert_to_openldap(self, target, mapping):
 208         return dsdb._dsdb_convert_schema_to_openldap(self.ldb, target, mapping)
 209
 210
 211 # Return a hash with the forward attribute as a key and the back as the value
 212 def get_linked_attributes(schemadn, schemaldb):
 213     attrs = ["linkID", "lDAPDisplayName"]
 214     res = schemaldb.search(
 215         expression="(&(linkID=*)"
 216                    "(!(linkID:1.2.840.113556.1.4.803:=1))"
 217                    "(objectclass=attributeSchema)"
 218                    "(attributeSyntax=2.5.5.1))",
 219         base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
 220     attributes = {}
 221     for i in range(0, len(res)):
 222         expression = ("(&(objectclass=attributeSchema)(linkID=%d)"
 223                       "(attributeSyntax=2.5.5.1))" %
 224                       (int(res[i]["linkID"][0]) + 1))
 225         target = schemaldb.searchone(basedn=schemadn,
 226                                      expression=expression,
 227                                      attribute="lDAPDisplayName",
 228                                      scope=SCOPE_SUBTREE)
 229         if target is not None:
 230             attributes[str(res[i]["lDAPDisplayName"])] = target.decode('utf-8')
 231
 232     return attributes
 233
 234
 235 def get_dnsyntax_attributes(schemadn, schemaldb):
 236     res = schemaldb.search(
 237         expression="(&(!(linkID=*))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))",
 238         base=schemadn, scope=SCOPE_ONELEVEL,
 239         attrs=["linkID", "lDAPDisplayName"])
 240     attributes = []
 241     for i in range(0, len(res)):
 242         attributes.append(str(res[i]["lDAPDisplayName"]))
 243     return attributes
 244
 245
 246 def ldb_with_schema(schemadn="cn=schema,cn=configuration,dc=example,dc=com",
 247                     domainsid=None,
 248                     override_prefixmap=None):
 249     """Load schema for the SamDB from the AD schema files and samba4_schema.ldif
 250
 251     :param schemadn: DN of the schema
 252     :param serverdn: DN of the server
 253
 254     Returns the schema data loaded as an object, with .ldb being a
 255     new ldb with the schema loaded.  This allows certain tests to
 256     operate without a remote or local schema.
 257     """
 258
 259     if domainsid is None:
 260         domainsid = security.random_sid()
 261     else:
 262         domainsid = security.dom_sid(domainsid)
 263     return Schema(domainsid, schemadn=schemadn,
 264                   override_prefixmap=override_prefixmap)