1 # Helpers for provision stuff
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2012
4 # Based on provision a Samba4 server by
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 """Helpers used for upgrading between different database formats."""
29 from samba import Ldb, version, ntacls
30 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
32 from samba.provision import (provision_paths_from_lp,
33 getpolicypath, set_gpos_acl, create_gpo_struct,
34 FILL_FULL, provision, ProvisioningError,
35 setsysvolacl, secretsdb_self_join)
36 from samba.dcerpc import xattr, drsblobs
37 from samba.dcerpc.misc import SEC_CHAN_BDC
38 from samba.ndr import ndr_unpack
39 from samba.samdb import SamDB
40 from samba import _glue
43 # All the ldb related to registry are commented because the path for them is
44 # relative in the provisionPath object
45 # And so opening them create a file in the current directory which is not what
47 # I still keep them commented because I plan soon to make more cleaner
56 hashAttrNotCopied = set(["dn", "whenCreated", "whenChanged", "objectGUID",
57 "uSNCreated", "replPropertyMetaData", "uSNChanged", "parentGUID",
58 "objectCategory", "distinguishedName", "nTMixedDomain",
59 "showInAdvancedViewOnly", "instanceType", "msDS-Behavior-Version",
60 "nextRid", "cn", "versionNumber", "lmPwdHistory", "pwdLastSet",
61 "ntPwdHistory", "unicodePwd","dBCSPwd", "supplementalCredentials",
62 "gPCUserExtensionNames", "gPCMachineExtensionNames","maxPwdAge", "secret",
63 "possibleInferiors", "privilege", "sAMAccountType"])
66 class ProvisionLDB(object):
79 return (self.sam, self.secrets, self.idmap, self.privilege)
81 def startTransactions(self):
83 db.transaction_start()
85 # self.hkcr.transaction_start()
86 # self.hkcu.transaction_start()
87 # self.hku.transaction_start()
88 # self.hklm.transaction_start()
90 def groupedRollback(self):
94 db.transaction_cancel()
99 # self.hkcr.transaction_cancel()
100 # self.hkcu.transaction_cancel()
101 # self.hku.transaction_cancel()
102 # self.hklm.transaction_cancel()
104 def groupedCommit(self):
106 for db in self.dbs():
107 db.transaction_prepare_commit()
109 return self.groupedRollback()
111 # self.hkcr.transaction_prepare_commit()
112 # self.hkcu.transaction_prepare_commit()
113 # self.hku.transaction_prepare_commit()
114 # self.hklm.transaction_prepare_commit()
116 for db in self.dbs():
117 db.transaction_commit()
119 return self.groupedRollback()
122 # self.hkcr.transaction_commit()
123 # self.hkcu.transaction_commit()
124 # self.hku.transaction_commit()
125 # self.hklm.transaction_commit()
129 def get_ldbs(paths, creds, session, lp):
130 """Return LDB object mapped on most important databases
132 :param paths: An object holding the different importants paths for provision object
133 :param creds: Credential used for openning LDB files
134 :param session: Session to use for openning LDB files
135 :param lp: A loadparam object
136 :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provision"""
138 ldbs = ProvisionLDB()
140 ldbs.sam = SamDB(paths.samdb, session_info=session, credentials=creds, lp=lp, options=["modules:samba_dsdb"])
141 ldbs.secrets = Ldb(paths.secrets, session_info=session, credentials=creds, lp=lp)
142 ldbs.idmap = Ldb(paths.idmapdb, session_info=session, credentials=creds, lp=lp)
143 ldbs.privilege = Ldb(paths.privilege, session_info=session, credentials=creds, lp=lp)
144 # ldbs.hkcr = Ldb(paths.hkcr, session_info=session, credentials=creds, lp=lp)
145 # ldbs.hkcu = Ldb(paths.hkcu, session_info=session, credentials=creds, lp=lp)
146 # ldbs.hku = Ldb(paths.hku, session_info=session, credentials=creds, lp=lp)
147 # ldbs.hklm = Ldb(paths.hklm, session_info=session, credentials=creds, lp=lp)
152 def usn_in_range(usn, range):
153 """Check if the usn is in one of the range provided.
154 To do so, the value is checked to be between the lower bound and
155 higher bound of a range
157 :param usn: A integer value corresponding to the usn that we want to update
158 :param range: A list of integer representing ranges, lower bounds are in
159 the even indices, higher in odd indices
160 :return: True if the usn is in one of the range, False otherwise
167 if idx == len(range):
170 if usn < int(range[idx]):
174 if usn == int(range[idx]):
181 def get_paths(param, targetdir=None, smbconf=None):
182 """Get paths to important provision objects (smb.conf, ldb files, ...)
184 :param param: Param object
185 :param targetdir: Directory where the provision is (or will be) stored
186 :param smbconf: Path to the smb.conf file
187 :return: A list with the path of important provision objects"""
188 if targetdir is not None:
189 if not os.path.exists(targetdir):
191 etcdir = os.path.join(targetdir, "etc")
192 if not os.path.exists(etcdir):
194 smbconf = os.path.join(etcdir, "smb.conf")
196 smbconf = param.default_path()
198 if not os.path.exists(smbconf):
199 raise ProvisioningError("Unable to find smb.conf")
201 lp = param.LoadParm()
203 paths = provision_paths_from_lp(lp, lp.get("realm"))
206 def update_policyids(names, samdb):
207 """Update policy ids that could have changed after sam update
209 :param names: List of key provision parameters
210 :param samdb: An Ldb object conntected with the sam DB
213 res = samdb.search(expression="(displayName=Default Domain Policy)",
214 base="CN=Policies,CN=System," + str(names.rootdn),
215 scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
216 names.policyid = str(res[0]["cn"]).replace("{","").replace("}","")
218 res2 = samdb.search(expression="(displayName=Default Domain Controllers"
220 base="CN=Policies,CN=System," + str(names.rootdn),
221 scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
223 names.policyid_dc = str(res2[0]["cn"]).replace("{","").replace("}","")
225 names.policyid_dc = None
228 def newprovision(names, creds, session, smbconf, provdir, logger):
229 """Create a new provision.
231 This provision will be the reference for knowing what has changed in the
232 since the latest upgrade in the current provision
234 :param names: List of provision parameters
235 :param creds: Credentials for the authentification
236 :param session: Session object
237 :param smbconf: Path to the smb.conf file
238 :param provdir: Directory where the provision will be stored
239 :param logger: A Logger
241 if os.path.isdir(provdir):
242 shutil.rmtree(provdir)
244 logger.info("Provision stored in %s", provdir)
245 return provision(logger, session, creds, smbconf=smbconf,
246 targetdir=provdir, samdb_fill=FILL_FULL, realm=names.realm,
247 domain=names.domain, domainguid=names.domainguid,
248 domainsid=str(names.domainsid), ntdsguid=names.ntdsguid,
249 policyguid=names.policyid, policyguid_dc=names.policyid_dc,
250 hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
251 invocationid=names.invocation, adminpass=names.adminpass,
252 krbtgtpass=None, machinepass=None, dnspass=None, root=None,
253 nobody=None, users=None,
254 serverrole="domain controller",
255 backend_type=None, ldapadminpass=None, ol_mmr_urls=None,
257 dom_for_fun_level=names.domainlevel, dns_backend=names.dns_backend,
258 useeadb=True, use_ntvfs=True)
262 """Sorts two DNs in the lexicographical order it and put higher level DN
265 So given the dns cn=bar,cn=foo and cn=foo the later will be return as
268 :param x: First object to compare
269 :param y: Second object to compare
271 p = re.compile(r'(?<!\\), ?')
272 tab1 = p.split(str(x))
273 tab2 = p.split(str(y))
274 minimum = min(len(tab1), len(tab2))
277 # Note: python range go up to upper limit but do not include it
278 for i in range(0, minimum):
279 ret = cmp(tab1[len1-i], tab2[len2-i])
284 assert len1!=len2,"PB PB PB" + " ".join(tab1)+" / " + " ".join(tab2)
292 def identic_rename(ldbobj, dn):
293 """Perform a back and forth rename to trigger renaming on attribute that
294 can't be directly modified.
296 :param lbdobj: An Ldb Object
297 :param dn: DN of the object to manipulate
299 (before, after) = str(dn).split('=', 1)
300 # we need to use relax to avoid the subtree_rename constraints
301 ldbobj.rename(dn, ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), ["relax:0"])
302 ldbobj.rename(ldb.Dn(ldbobj, "%s=foo%s" % (before, after)), dn, ["relax:0"])
306 """Return separate ACE of an ACL
308 :param acl: A string representing the ACL
309 :return: A hash with different parts
312 p = re.compile(r'(\w+)?(\(.*?\))')
320 hash["aces"].append(e[1])
325 def chunck_sddl(sddl):
326 """ Return separate parts of the SDDL (owner, group, ...)
328 :param sddl: An string containing the SDDL to chunk
329 :return: A hash with the different chunk
332 p = re.compile(r'([OGDS]:)(.*?)(?=(?:[GDS]:|$))')
333 tab = p.findall(sddl)
349 def get_diff_sddls(refsddl, cursddl, checkSacl = True):
350 """Get the difference between 2 sddl
352 This function split the textual representation of ACL into smaller
353 chunck in order to not to report a simple permutation as a difference
355 :param refsddl: First sddl to compare
356 :param cursddl: Second sddl to compare
357 :param checkSacl: If false we skip the sacl checks
358 :return: A string that explain difference between sddls
362 hash_cur = chunck_sddl(cursddl)
363 hash_ref = chunck_sddl(refsddl)
365 if not hash_cur.has_key("owner"):
366 txt = "\tNo owner in current SD"
367 elif hash_cur["owner"] != hash_ref["owner"]:
368 txt = "\tOwner mismatch: %s (in ref) %s" \
369 "(in current)\n" % (hash_ref["owner"], hash_cur["owner"])
371 if not hash_cur.has_key("group"):
372 txt = "%s\tNo group in current SD" % txt
373 elif hash_cur["group"] != hash_ref["group"]:
374 txt = "%s\tGroup mismatch: %s (in ref) %s" \
375 "(in current)\n" % (txt, hash_ref["group"], hash_cur["group"])
381 if hash_cur.has_key(part) and hash_ref.has_key(part):
383 # both are present, check if they contain the same ACE
386 c_cur = chunck_acl(hash_cur[part])
387 c_ref = chunck_acl(hash_ref[part])
389 for elem in c_cur["aces"]:
392 for elem in c_ref["aces"]:
400 if len(h_cur) + len(h_ref) > 0:
401 txt = "%s\tPart %s is different between reference" \
402 " and current here is the detail:\n" % (txt, part)
405 txt = "%s\t\t%s ACE is not present in the" \
406 " reference\n" % (txt, item)
409 txt = "%s\t\t%s ACE is not present in the" \
410 " current\n" % (txt, item)
412 elif hash_cur.has_key(part) and not hash_ref.has_key(part):
413 txt = "%s\tReference ACL hasn't a %s part\n" % (txt, part)
414 elif not hash_cur.has_key(part) and hash_ref.has_key(part):
415 txt = "%s\tCurrent ACL hasn't a %s part\n" % (txt, part)
420 def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
421 """Update secrets.ldb
423 :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
424 of the reference provision
425 :param secrets_ldb: An LDB object that is connected to the secrets.ldb
426 of the updated provision
429 messagefunc(SIMPLE, "Update of secrets.ldb")
430 reference = newsecrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
431 current = secrets_ldb.search(base="@MODULES", scope=SCOPE_BASE)
432 assert reference, "Reference modules list can not be empty"
433 if len(current) == 0:
435 delta = secrets_ldb.msg_diff(ldb.Message(), reference[0])
436 delta.dn = reference[0].dn
437 secrets_ldb.add(reference[0])
439 delta = secrets_ldb.msg_diff(current[0], reference[0])
440 delta.dn = current[0].dn
441 secrets_ldb.modify(delta)
443 reference = newsecrets_ldb.search(expression="objectClass=top", base="",
444 scope=SCOPE_SUBTREE, attrs=["dn"])
445 current = secrets_ldb.search(expression="objectClass=top", base="",
446 scope=SCOPE_SUBTREE, attrs=["dn"])
452 empty = ldb.Message()
453 for i in range(0, len(reference)):
454 hash_new[str(reference[i]["dn"]).lower()] = reference[i]["dn"]
456 # Create a hash for speeding the search of existing object in the
458 for i in range(0, len(current)):
459 hash[str(current[i]["dn"]).lower()] = current[i]["dn"]
461 for k in hash_new.keys():
462 if not hash.has_key(k):
463 listMissing.append(hash_new[k])
465 listPresent.append(hash_new[k])
467 for entry in listMissing:
468 reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
469 base="", scope=SCOPE_SUBTREE)
470 current = secrets_ldb.search(expression="distinguishedName=%s" % entry,
471 base="", scope=SCOPE_SUBTREE)
472 delta = secrets_ldb.msg_diff(empty, reference[0])
473 for att in hashAttrNotCopied:
475 messagefunc(CHANGE, "Entry %s is missing from secrets.ldb" %
478 messagefunc(CHANGE, " Adding attribute %s" % att)
479 delta.dn = reference[0].dn
480 secrets_ldb.add(delta)
482 for entry in listPresent:
483 reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry,
484 base="", scope=SCOPE_SUBTREE)
485 current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
487 delta = secrets_ldb.msg_diff(current[0], reference[0])
488 for att in hashAttrNotCopied:
492 messagefunc(CHANGE, "Found attribute name on %s,"
493 " must rename the DN" % (current[0].dn))
494 identic_rename(secrets_ldb, reference[0].dn)
498 for entry in listPresent:
499 reference = newsecrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
501 current = secrets_ldb.search(expression="distinguishedName=%s" % entry, base="",
503 delta = secrets_ldb.msg_diff(current[0], reference[0])
504 for att in hashAttrNotCopied:
507 if att == "msDS-KeyVersionNumber":
511 "Adding/Changing attribute %s to %s" %
512 (att, current[0].dn))
514 delta.dn = current[0].dn
515 secrets_ldb.modify(delta)
517 res2 = secrets_ldb.search(expression="(samaccountname=dns)",
518 scope=SCOPE_SUBTREE, attrs=["dn"])
521 messagefunc(SIMPLE, "Remove old dns account")
522 secrets_ldb.delete(res2[0]["dn"])
525 def getOEMInfo(samdb, rootdn):
526 """Return OEM Information on the top level Samba4 use to store version
529 :param samdb: An LDB object connect to sam.ldb
530 :param rootdn: Root DN of the domain
531 :return: The content of the field oEMInformation (if any)
533 res = samdb.search(expression="(objectClass=*)", base=str(rootdn),
534 scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
535 if len(res) > 0 and res[0].get("oEMInformation"):
536 info = res[0]["oEMInformation"]
542 def updateOEMInfo(samdb, rootdn):
543 """Update the OEMinfo field to add information about upgrade
545 :param samdb: an LDB object connected to the sam DB
546 :param rootdn: The string representation of the root DN of
547 the provision (ie. DC=...,DC=...)
549 res = samdb.search(expression="(objectClass=*)", base=rootdn,
550 scope=SCOPE_BASE, attrs=["dn", "oEMInformation"])
552 if res[0].get("oEMInformation"):
553 info = str(res[0]["oEMInformation"])
556 info = "%s, upgrade to %s" % (info, version)
557 delta = ldb.Message()
558 delta.dn = ldb.Dn(samdb, str(res[0]["dn"]))
559 delta["oEMInformation"] = ldb.MessageElement(info, ldb.FLAG_MOD_REPLACE,
563 def update_gpo(paths, samdb, names, lp, message):
564 """Create missing GPO file object if needed
566 dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid)
567 if not os.path.isdir(dir):
568 create_gpo_struct(dir)
570 if names.policyid_dc is None:
571 raise ProvisioningError("Policy ID for Domain controller is missing")
572 dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
573 if not os.path.isdir(dir):
574 create_gpo_struct(dir)
576 def increment_calculated_keyversion_number(samdb, rootdn, hashDns):
577 """For a given hash associating dn and a number, this function will
578 update the replPropertyMetaData of each dn in the hash, so that the
579 calculated value of the msDs-KeyVersionNumber is equal or superior to the
580 one associated to the given dn.
582 :param samdb: An SamDB object pointing to the sam
583 :param rootdn: The base DN where we want to start
584 :param hashDns: A hash with dn as key and number representing the
585 minimum value of msDs-KeyVersionNumber that we want to
588 entry = samdb.search(expression='(objectClass=user)',
589 base=ldb.Dn(samdb,str(rootdn)),
590 scope=SCOPE_SUBTREE, attrs=["msDs-KeyVersionNumber"],
591 controls=["search_options:1:2"])
595 raise ProvisioningError("Unable to find msDs-KeyVersionNumber")
598 if hashDns.has_key(str(e.dn).lower()):
599 val = e.get("msDs-KeyVersionNumber")
602 version = int(str(hashDns[str(e.dn).lower()]))
603 if int(str(val)) < version:
605 samdb.set_attribute_replmetadata_version(str(e.dn),
608 def delta_update_basesamdb(refsampath, sampath, creds, session, lp, message):
609 """Update the provision container db: sam.ldb
610 This function is aimed for alpha9 and newer;
612 :param refsampath: Path to the samdb in the reference provision
613 :param sampath: Path to the samdb in the upgraded provision
614 :param creds: Credential used for openning LDB files
615 :param session: Session to use for openning LDB files
616 :param lp: A loadparam object
617 :return: A msg_diff object with the difference between the @ATTRIBUTES
618 of the current provision and the reference provision
622 "Update base samdb by searching difference with reference one")
623 refsam = Ldb(refsampath, session_info=session, credentials=creds,
624 lp=lp, options=["modules:"])
625 sam = Ldb(sampath, session_info=session, credentials=creds, lp=lp,
626 options=["modules:"])
628 empty = ldb.Message()
630 reference = refsam.search(expression="")
632 for refentry in reference:
633 entry = sam.search(expression="distinguishedName=%s" % refentry["dn"],
636 delta = sam.msg_diff(empty, refentry)
637 message(CHANGE, "Adding %s to sam db" % str(refentry.dn))
638 if str(refentry.dn) == "@PROVISION" and\
639 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
640 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
641 delta.dn = refentry.dn
644 delta = sam.msg_diff(entry[0], refentry)
645 if str(refentry.dn) == "@ATTRIBUTES":
646 deltaattr = sam.msg_diff(refentry, entry[0])
647 if str(refentry.dn) == "@PROVISION" and\
648 delta.get(samba.provision.LAST_PROVISION_USN_ATTRIBUTE):
649 delta.remove(samba.provision.LAST_PROVISION_USN_ATTRIBUTE)
650 if len(delta.items()) > 1:
651 delta.dn = refentry.dn
657 def construct_existor_expr(attrs):
658 """Construct a exists or LDAP search expression.
660 :param attrs: List of attribute on which we want to create the search
662 :return: A string representing the expression, if attrs is empty an
663 empty string is returned
669 expr = "%s(%s=*)"%(expr,att)
673 def update_machine_account_password(samdb, secrets_ldb, names):
674 """Update (change) the password of the current DC both in the SAM db and in
677 :param samdb: An LDB object related to the sam.ldb file of a given provision
678 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
680 :param names: List of key provision parameters"""
682 expression = "samAccountName=%s$" % names.netbiosname
683 secrets_msg = secrets_ldb.search(expression=expression,
684 attrs=["secureChannelType"])
685 if int(secrets_msg[0]["secureChannelType"][0]) == SEC_CHAN_BDC:
686 res = samdb.search(expression=expression, attrs=[])
687 assert(len(res) == 1)
689 msg = ldb.Message(res[0].dn)
690 machinepass = samba.generate_random_password(128, 255)
691 mputf16 = machinepass.encode('utf-16-le')
692 msg["clearTextPassword"] = ldb.MessageElement(mputf16,
693 ldb.FLAG_MOD_REPLACE,
697 res = samdb.search(expression=("samAccountName=%s$" % names.netbiosname),
698 attrs=["msDs-keyVersionNumber"])
699 assert(len(res) == 1)
700 kvno = int(str(res[0]["msDs-keyVersionNumber"]))
701 secChanType = int(secrets_msg[0]["secureChannelType"][0])
703 secretsdb_self_join(secrets_ldb, domain=names.domain,
705 domainsid=names.domainsid,
706 dnsdomain=names.dnsdomain,
707 netbiosname=names.netbiosname,
708 machinepass=machinepass,
709 key_version_number=kvno,
710 secure_channel_type=secChanType)
712 raise ProvisioningError("Unable to find a Secure Channel"
713 "of type SEC_CHAN_BDC")
715 def update_dns_account_password(samdb, secrets_ldb, names):
716 """Update (change) the password of the dns both in the SAM db and in
719 :param samdb: An LDB object related to the sam.ldb file of a given provision
720 :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
722 :param names: List of key provision parameters"""
724 expression = "samAccountName=dns-%s" % names.netbiosname
725 secrets_msg = secrets_ldb.search(expression=expression)
726 if len(secrets_msg) == 1:
727 res = samdb.search(expression=expression, attrs=[])
728 assert(len(res) == 1)
730 msg = ldb.Message(res[0].dn)
731 machinepass = samba.generate_random_password(128, 255)
732 mputf16 = machinepass.encode('utf-16-le')
733 msg["clearTextPassword"] = ldb.MessageElement(mputf16,
734 ldb.FLAG_MOD_REPLACE,
739 res = samdb.search(expression=expression,
740 attrs=["msDs-keyVersionNumber"])
741 assert(len(res) == 1)
742 kvno = str(res[0]["msDs-keyVersionNumber"])
744 msg = ldb.Message(secrets_msg[0].dn)
745 msg["secret"] = ldb.MessageElement(machinepass,
746 ldb.FLAG_MOD_REPLACE,
748 msg["msDS-KeyVersionNumber"] = ldb.MessageElement(kvno,
749 ldb.FLAG_MOD_REPLACE,
750 "msDS-KeyVersionNumber")
752 secrets_ldb.modify(msg)
754 def search_constructed_attrs_stored(samdb, rootdn, attrs):
755 """Search a given sam DB for calculated attributes that are
756 still stored in the db.
758 :param samdb: An LDB object pointing to the sam
759 :param rootdn: The base DN where the search should start
760 :param attrs: A list of attributes to be searched
761 :return: A hash with attributes as key and an array of
762 array. Each array contains the dn and the associated
763 values for this attribute as they are stored in the
767 expr = construct_existor_expr(attrs)
770 entry = samdb.search(expression=expr, base=ldb.Dn(samdb, str(rootdn)),
771 scope=SCOPE_SUBTREE, attrs=attrs,
772 controls=["search_options:1:2","bypassoperational:0"])
780 if hashAtt.has_key(att):
781 hashAtt[att][str(ent.dn).lower()] = str(ent[att])
784 hashAtt[att][str(ent.dn).lower()] = str(ent[att])
788 def findprovisionrange(samdb, basedn):
789 """ Find ranges of usn grouped by invocation id and then by timestamp
792 :param samdb: An LDB object pointing to the samdb
793 :param basedn: The DN of the forest
795 :return: A two level dictionary with invoication id as the
796 first level, timestamp as the second one and then
797 max, min, and number as subkeys, representing respectivily
798 the maximum usn for the range, the minimum usn and the number
799 of object with usn in this range.
804 res = samdb.search(base=basedn, expression="objectClass=*",
805 scope=ldb.SCOPE_SUBTREE,
806 attrs=["replPropertyMetaData"],
807 controls=["search_options:1:2"])
811 obj = ndr_unpack(drsblobs.replPropertyMetaDataBlob,
812 str(e["replPropertyMetaData"])).ctr
815 # like a timestamp but with the resolution of 1 minute
816 minutestamp =_glue.nttime2unix(o.originating_change_time)/60
817 hash_ts = hash_id.get(str(o.originating_invocation_id))
821 ob["min"] = o.originating_usn
822 ob["max"] = o.originating_usn
824 ob["list"] = [str(e.dn)]
827 ob = hash_ts.get(minutestamp)
830 ob["min"] = o.originating_usn
831 ob["max"] = o.originating_usn
833 ob["list"] = [str(e.dn)]
835 if ob["min"] > o.originating_usn:
836 ob["min"] = o.originating_usn
837 if ob["max"] < o.originating_usn:
838 ob["max"] = o.originating_usn
839 if not (str(e.dn) in ob["list"]):
840 ob["num"] = ob["num"] + 1
841 ob["list"].append(str(e.dn))
842 hash_ts[minutestamp] = ob
843 hash_id[str(o.originating_invocation_id)] = hash_ts
845 return (hash_id, nb_obj)
847 def print_provision_ranges(dic, limit_print, dest, samdb_path, invocationid):
848 """ print the differents ranges passed as parameter
850 :param dic: A dictionnary as returned by findprovisionrange
851 :param limit_print: minimum number of object in a range in order to print it
852 :param dest: Destination directory
853 :param samdb_path: Path to the sam.ldb file
854 :param invoicationid: Invocation ID for the current provision
861 sorted_keys.extend(hash_ts.keys())
865 for k in sorted_keys:
867 if obj["num"] > limit_print:
868 dt = _glue.nttime2string(_glue.unix2nttime(k*60))
869 print "%s # of modification: %d \tmin: %d max: %d" % (dt , obj["num"],
872 if hash_ts[k]["num"] > 600:
873 kept_record.append(k)
875 # Let's try to concatenate consecutive block if they are in the almost same minutestamp
876 for i in range(0, len(kept_record)):
878 key1 = kept_record[i]
879 key2 = kept_record[i-1]
881 # previous record is just 1 minute away from current
882 if int(hash_ts[key1]["min"]) == int(hash_ts[key2]["max"]) + 1:
883 # Copy the highest USN in the previous record
884 # and mark the current as skipped
885 hash_ts[key2]["max"] = hash_ts[key1]["max"]
886 hash_ts[key1]["skipped"] = True
888 for k in kept_record:
890 if obj.get("skipped") is None:
891 ldif = "%slastProvisionUSN: %d-%d;%s\n" % (ldif, obj["min"],
895 file = tempfile.mktemp(dir=dest, prefix="usnprov", suffix=".ldif")
897 print "To track the USNs modified/created by provision and upgrade proivsion,"
898 print " the following ranges are proposed to be added to your provision sam.ldb: \n%s" % ldif
899 print "We recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldb" % file
900 print "You can load this file like this: ldbadd -H %s %s\n"%(str(samdb_path),file)
901 ldif = "dn: @PROVISION\nprovisionnerID: %s\n%s" % (invocationid, ldif)
902 open(file,'w').write(ldif)
904 def int64range2str(value):
905 """Display the int64 range stored in value as xxx-yyy
907 :param value: The int64 range
908 :return: A string of the representation of the range
912 str = "%d-%d" % (lvalue&0xFFFFFFFF, lvalue>>32)