mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
405 lines
13 KiB
Python
405 lines
13 KiB
Python
#!/usr/bin/python
|
|
|
|
# Unix SMB/CIFS implementation.
|
|
# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
|
|
#
|
|
# Based on the original in EJS:
|
|
# Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
"""Samba 4."""
|
|
|
|
__docformat__ = "restructuredText"
|
|
|
|
import os
|
|
import sys
|
|
|
|
def _in_source_tree():
|
|
"""Check whether the script is being run from the source dir. """
|
|
return os.path.exists("%s/../../../selftest/skip" % os.path.dirname(__file__))
|
|
|
|
|
|
# When running, in-tree, make sure bin/python is in the PYTHONPATH
|
|
if _in_source_tree():
|
|
srcdir = "%s/../../.." % os.path.dirname(__file__)
|
|
sys.path.append("%s/bin/python" % srcdir)
|
|
default_ldb_modules_dir = "%s/bin/modules/ldb" % srcdir
|
|
else:
|
|
default_ldb_modules_dir = None
|
|
|
|
|
|
import ldb
|
|
import dsdb
|
|
import _glue
|
|
from samba._ldb import Ldb as _Ldb
|
|
|
|
class Ldb(_Ldb):
|
|
"""Simple Samba-specific LDB subclass that takes care
|
|
of setting up the modules dir, credentials pointers, etc.
|
|
|
|
Please note that this is intended to be for all Samba LDB files,
|
|
not necessarily the Sam database. For Sam-specific helper
|
|
functions see samdb.py.
|
|
"""
|
|
def __init__(self, url=None, lp=None, modules_dir=None, session_info=None,
|
|
credentials=None, flags=0, options=None):
|
|
"""Opens a Samba Ldb file.
|
|
|
|
:param url: Optional LDB URL to open
|
|
:param lp: Optional loadparm object
|
|
:param modules_dir: Optional modules directory
|
|
:param session_info: Optional session information
|
|
:param credentials: Optional credentials, defaults to anonymous.
|
|
:param flags: Optional LDB flags
|
|
:param options: Additional options (optional)
|
|
|
|
This is different from a regular Ldb file in that the Samba-specific
|
|
modules-dir is used by default and that credentials and session_info
|
|
can be passed through (required by some modules).
|
|
"""
|
|
|
|
if modules_dir is not None:
|
|
self.set_modules_dir(modules_dir)
|
|
elif default_ldb_modules_dir is not None:
|
|
self.set_modules_dir(default_ldb_modules_dir)
|
|
elif lp is not None:
|
|
self.set_modules_dir(os.path.join(lp.get("modules dir"), "ldb"))
|
|
|
|
if session_info is not None:
|
|
self.set_session_info(session_info)
|
|
|
|
if credentials is not None:
|
|
self.set_credentials(credentials)
|
|
|
|
if lp is not None:
|
|
self.set_loadparm(lp)
|
|
|
|
# This must be done before we load the schema, as these handlers for
|
|
# objectSid and objectGUID etc must take precedence over the 'binary
|
|
# attribute' declaration in the schema
|
|
self.register_samba_handlers()
|
|
|
|
# TODO set debug
|
|
def msg(l,text):
|
|
print text
|
|
#self.set_debug(msg)
|
|
|
|
self.set_utf8_casefold()
|
|
|
|
# Allow admins to force non-sync ldb for all databases
|
|
if lp is not None:
|
|
nosync_p = lp.get("nosync", "ldb")
|
|
if nosync_p is not None and nosync_p == True:
|
|
flags |= ldb.FLG_NOSYNC
|
|
|
|
self.set_create_perms()
|
|
|
|
if url is not None:
|
|
self.connect(url, flags, options)
|
|
|
|
def set_create_perms(self, perms=0600):
|
|
# we usually want Samba databases to be private. If we later find we
|
|
# need one public, we will have to change this here
|
|
super(Ldb, self).set_create_perms(perms)
|
|
|
|
def searchone(self, attribute, basedn=None, expression=None,
|
|
scope=ldb.SCOPE_BASE):
|
|
"""Search for one attribute as a string.
|
|
|
|
:param basedn: BaseDN for the search.
|
|
:param attribute: Name of the attribute
|
|
:param expression: Optional search expression.
|
|
:param scope: Search scope (defaults to base).
|
|
:return: Value of attribute as a string or None if it wasn't found.
|
|
"""
|
|
res = self.search(basedn, scope, expression, [attribute])
|
|
if len(res) != 1 or res[0][attribute] is None:
|
|
return None
|
|
values = set(res[0][attribute])
|
|
assert len(values) == 1
|
|
return self.schema_format_value(attribute, values.pop())
|
|
|
|
def erase_users_computers(self, dn):
|
|
"""Erases user and computer objects from our AD. This is needed since the 'samldb' module denies the deletion of primary groups. Therefore all groups shouldn't be primary somewhere anymore."""
|
|
|
|
try:
|
|
res = self.search(base=dn, scope=ldb.SCOPE_SUBTREE, attrs=[],
|
|
expression="(|(objectclass=user)(objectclass=computer))")
|
|
except ldb.LdbError, (errno, _):
|
|
if errno == ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore no such object errors
|
|
return
|
|
else:
|
|
raise
|
|
|
|
try:
|
|
for msg in res:
|
|
self.delete(msg.dn)
|
|
except ldb.LdbError, (errno, _):
|
|
if errno != ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore no such object errors
|
|
raise
|
|
|
|
def erase_except_schema_controlled(self):
|
|
"""Erase this ldb, removing all records, except those that are controlled by Samba4's schema."""
|
|
|
|
basedn = ""
|
|
|
|
# Try to delete user/computer accounts to allow deletion of groups
|
|
self.erase_users_computers(basedn)
|
|
|
|
# Delete the 'visible' records, and the invisble 'deleted' records (if this DB supports it)
|
|
for msg in self.search(basedn, ldb.SCOPE_SUBTREE,
|
|
"(&(|(objectclass=*)(distinguishedName=*))(!(distinguishedName=@BASEINFO)))",
|
|
[], controls=["show_deleted:0"]):
|
|
try:
|
|
self.delete(msg.dn)
|
|
except ldb.LdbError, (errno, _):
|
|
if errno != ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore no such object errors
|
|
raise
|
|
|
|
res = self.search(basedn, ldb.SCOPE_SUBTREE,
|
|
"(&(|(objectclass=*)(distinguishedName=*))(!(distinguishedName=@BASEINFO)))",
|
|
[], controls=["show_deleted:0"])
|
|
assert len(res) == 0
|
|
|
|
# delete the specials
|
|
for attr in ["@SUBCLASSES", "@MODULES",
|
|
"@OPTIONS", "@PARTITION", "@KLUDGEACL"]:
|
|
try:
|
|
self.delete(attr)
|
|
except ldb.LdbError, (errno, _):
|
|
if errno != ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore missing dn errors
|
|
raise
|
|
|
|
def erase(self):
|
|
"""Erase this ldb, removing all records."""
|
|
|
|
self.erase_except_schema_controlled()
|
|
|
|
# delete the specials
|
|
for attr in ["@INDEXLIST", "@ATTRIBUTES"]:
|
|
try:
|
|
self.delete(attr)
|
|
except ldb.LdbError, (errno, _):
|
|
if errno != ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore missing dn errors
|
|
raise
|
|
|
|
def erase_partitions(self):
|
|
"""Erase an ldb, removing all records."""
|
|
|
|
def erase_recursive(self, dn):
|
|
try:
|
|
res = self.search(base=dn, scope=ldb.SCOPE_ONELEVEL, attrs=[],
|
|
controls=["show_deleted:0"])
|
|
except ldb.LdbError, (errno, _):
|
|
if errno == ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore no such object errors
|
|
return
|
|
|
|
for msg in res:
|
|
erase_recursive(self, msg.dn)
|
|
|
|
try:
|
|
self.delete(dn)
|
|
except ldb.LdbError, (errno, _):
|
|
if errno != ldb.ERR_NO_SUCH_OBJECT:
|
|
# Ignore no such object errors
|
|
raise
|
|
|
|
res = self.search("", ldb.SCOPE_BASE, "(objectClass=*)",
|
|
["namingContexts"])
|
|
assert len(res) == 1
|
|
if not "namingContexts" in res[0]:
|
|
return
|
|
for basedn in res[0]["namingContexts"]:
|
|
# Try to delete user/computer accounts to allow deletion of groups
|
|
self.erase_users_computers(basedn)
|
|
# Try and erase from the bottom-up in the tree
|
|
erase_recursive(self, basedn)
|
|
|
|
def load_ldif_file_add(self, ldif_path):
|
|
"""Load a LDIF file.
|
|
|
|
:param ldif_path: Path to LDIF file.
|
|
"""
|
|
self.add_ldif(open(ldif_path, 'r').read())
|
|
|
|
def add_ldif(self, ldif, controls=None):
|
|
"""Add data based on a LDIF string.
|
|
|
|
:param ldif: LDIF text.
|
|
"""
|
|
for changetype, msg in self.parse_ldif(ldif):
|
|
assert changetype == ldb.CHANGETYPE_NONE
|
|
self.add(msg,controls)
|
|
|
|
def modify_ldif(self, ldif, controls=None):
|
|
"""Modify database based on a LDIF string.
|
|
|
|
:param ldif: LDIF text.
|
|
"""
|
|
for changetype, msg in self.parse_ldif(ldif):
|
|
if (changetype == ldb.CHANGETYPE_ADD):
|
|
self.add(msg, controls)
|
|
else:
|
|
self.modify(msg, controls)
|
|
|
|
def set_domain_sid(self, sid):
|
|
"""Change the domain SID used by this LDB.
|
|
|
|
:param sid: The new domain sid to use.
|
|
"""
|
|
dsdb.samdb_set_domain_sid(self, sid)
|
|
|
|
def domain_sid(self):
|
|
"""Read the domain SID used by this LDB.
|
|
|
|
"""
|
|
dsdb.samdb_get_domain_sid(self)
|
|
|
|
def set_schema_from_ldif(self, pf, df):
|
|
_glue.dsdb_set_schema_from_ldif(self, pf, df)
|
|
|
|
def set_schema_from_ldb(self, ldb):
|
|
_glue.dsdb_set_schema_from_ldb(self, ldb)
|
|
|
|
def write_prefixes_from_schema(self):
|
|
_glue.dsdb_write_prefixes_from_schema_to_ldb(self)
|
|
|
|
def convert_schema_to_openldap(self, target, mapping):
|
|
return dsdb.dsdb_convert_schema_to_openldap(self, target, mapping)
|
|
|
|
def set_invocation_id(self, invocation_id):
|
|
"""Set the invocation id for this SamDB handle.
|
|
|
|
:param invocation_id: GUID of the invocation id.
|
|
"""
|
|
dsdb.dsdb_set_ntds_invocation_id(self, invocation_id)
|
|
|
|
def get_invocation_id(self):
|
|
"Get the invocation_id id"
|
|
return dsdb.samdb_ntds_invocation_id(self)
|
|
|
|
def get_ntds_GUID(self):
|
|
"Get the NTDS objectGUID"
|
|
return dsdb.samdb_ntds_objectGUID(self)
|
|
|
|
def server_site_name(self):
|
|
"Get the server site name"
|
|
return dsdb.samdb_server_site_name(self)
|
|
|
|
|
|
def substitute_var(text, values):
|
|
"""substitute strings of the form ${NAME} in str, replacing
|
|
with substitutions from subobj.
|
|
|
|
:param text: Text in which to subsitute.
|
|
:param values: Dictionary with keys and values.
|
|
"""
|
|
|
|
for (name, value) in values.items():
|
|
assert isinstance(name, str), "%r is not a string" % name
|
|
assert isinstance(value, str), "Value %r for %s is not a string" % (value, name)
|
|
text = text.replace("${%s}" % name, value)
|
|
|
|
return text
|
|
|
|
|
|
def check_all_substituted(text):
|
|
"""Make sure that all substitution variables in a string have been replaced.
|
|
If not, raise an exception.
|
|
|
|
:param text: The text to search for substitution variables
|
|
"""
|
|
if not "${" in text:
|
|
return
|
|
|
|
var_start = text.find("${")
|
|
var_end = text.find("}", var_start)
|
|
|
|
raise Exception("Not all variables substituted: %s" % text[var_start:var_end+1])
|
|
|
|
|
|
def read_and_sub_file(file, subst_vars):
|
|
"""Read a file and sub in variables found in it
|
|
|
|
:param file: File to be read (typically from setup directory)
|
|
param subst_vars: Optional variables to subsitute in the file.
|
|
"""
|
|
data = open(file, 'r').read()
|
|
if subst_vars is not None:
|
|
data = substitute_var(data, subst_vars)
|
|
check_all_substituted(data)
|
|
return data
|
|
|
|
|
|
def setup_file(template, fname, subst_vars=None):
|
|
"""Setup a file in the private dir.
|
|
|
|
:param template: Path of the template file.
|
|
:param fname: Path of the file to create.
|
|
:param subst_vars: Substitution variables.
|
|
"""
|
|
f = fname
|
|
|
|
if os.path.exists(f):
|
|
os.unlink(f)
|
|
|
|
data = read_and_sub_file(template, subst_vars)
|
|
open(f, 'w').write(data)
|
|
|
|
|
|
def valid_netbios_name(name):
|
|
"""Check whether a name is valid as a NetBIOS name. """
|
|
# See crh's book (1.4.1.1)
|
|
if len(name) > 15:
|
|
return False
|
|
for x in name:
|
|
if not x.isalnum() and not x in " !#$%&'()-.@^_{}~":
|
|
return False
|
|
return True
|
|
|
|
|
|
def ensure_external_module(modulename, location):
|
|
"""Add a location to sys.path if an external dependency can't be found.
|
|
|
|
:param modulename: Module name to import
|
|
:param location: Location to add to sys.path (can be relative to
|
|
${srcdir}/lib
|
|
"""
|
|
try:
|
|
__import__(modulename)
|
|
except ImportError:
|
|
import sys
|
|
if _in_source_tree():
|
|
sys.path.insert(0,
|
|
os.path.join(os.path.dirname(__file__),
|
|
"../../../../lib", location))
|
|
__import__(modulename)
|
|
else:
|
|
sys.modules[modulename] = __import__(
|
|
"samba.external.%s" % modulename, fromlist=["samba.external"])
|
|
|
|
version = _glue.version
|
|
interface_ips = _glue.interface_ips
|
|
set_debug_level = _glue.set_debug_level
|
|
unix2nttime = _glue.unix2nttime
|
|
generate_random_password = _glue.generate_random_password
|