← Back to branch summary

~lefteris-nikoltsios/+junk/samba-lp1016895

« back to all changes in this revision

Viewing changes to source4/scripting/python/samba/netcmd/domainlevel.py

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source4/scripting/python/samba/netcmd/domainlevel.py
 
1
#!/usr/bin/env python
 
2
#
 
3
# Raises domain and forest function levels
 
4
#
 
5
# Copyright Matthias Dieter Wallnoefer 2009
 
6
# Copyright Jelmer Vernooij 2009
 
7
#
 
8
# This program is free software; you can redistribute it and/or modify
 
9
# it under the terms of the GNU General Public License as published by
 
10
# the Free Software Foundation; either version 3 of the License, or
 
11
# (at your option) any later version.
 
12
#
 
13
# This program is distributed in the hope that it will be useful,
 
14
# but WITHOUT ANY WARRANTY; without even the implied warranty of
 
15
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
16
# GNU General Public License for more details.
 
17
#
 
18
# You should have received a copy of the GNU General Public License
 
19
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
20
#
 
21
 
 
22
# Notice: At the moment we have some more checks to do here on the special
 
23
# attributes (consider attribute "msDS-Behavior-Version). This is due to the
 
24
# fact that we on s4 LDB don't implement their change policy (only certain
 
25
# values, only increments possible...) yet.
 
26
 
 
27
import samba.getopt as options
 
28
import ldb
 
29
 
 
30
from samba.auth import system_session
 
31
from samba.netcmd import (
 
32
    Command,
 
33
    CommandError,
 
34
    Option,
 
35
    )
 
36
from samba.samdb import SamDB
 
37
from samba.dsdb import (
 
38
    DS_DOMAIN_FUNCTION_2000,
 
39
    DS_DOMAIN_FUNCTION_2003,
 
40
    DS_DOMAIN_FUNCTION_2003_MIXED,
 
41
    DS_DOMAIN_FUNCTION_2008,
 
42
    DS_DOMAIN_FUNCTION_2008_R2,
 
43
    )
 
44
 
 
45
class cmd_domainlevel(Command):
 
46
    """Raises domain and forest function levels"""
 
47
 
 
48
    synopsis = "(show | raise <options>)"
 
49
 
 
50
    takes_optiongroups = {
 
51
        "sambaopts": options.SambaOptions,
 
52
        "credopts": options.CredentialsOptions,
 
53
        "versionopts": options.VersionOptions,
 
54
        }
 
55
 
 
56
    takes_options = [
 
57
        Option("-H", help="LDB URL for database or target server", type=str),
 
58
        Option("--quiet", help="Be quiet", action="store_true"),
 
59
        Option("--forest", type="choice", choices=["2003", "2008", "2008_R2"],
 
60
            help="The forest function level (2003 | 2008 | 2008_R2)"),
 
61
        Option("--domain", type="choice", choices=["2003", "2008", "2008_R2"],
 
62
            help="The domain function level (2003 | 2008 | 2008_R2)"),
 
63
        ]
 
64
 
 
65
    takes_args = ["subcommand"]
 
66
 
 
67
    def run(self, subcommand, H=None, forest=None, domain=None, quiet=False,
 
68
            credopts=None, sambaopts=None, versionopts=None):
 
69
        lp = sambaopts.get_loadparm()
 
70
        creds = credopts.get_credentials(lp, fallback_machine=True)
 
71
 
 
72
        samdb = SamDB(url=H, session_info=system_session(),
 
73
            credentials=creds, lp=lp)
 
74
 
 
75
        domain_dn = samdb.domain_dn()
 
76
 
 
77
        res_forest = samdb.search("CN=Partitions,CN=Configuration," + domain_dn,
 
78
          scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
 
79
        assert len(res_forest) == 1
 
80
 
 
81
        res_domain = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
 
82
          attrs=["msDS-Behavior-Version", "nTMixedDomain"])
 
83
        assert len(res_domain) == 1
 
84
 
 
85
        res_dc_s = samdb.search("CN=Sites,CN=Configuration," + domain_dn,
 
86
          scope=ldb.SCOPE_SUBTREE, expression="(objectClass=nTDSDSA)",
 
87
          attrs=["msDS-Behavior-Version"])
 
88
        assert len(res_dc_s) >= 1
 
89
 
 
90
        try:
 
91
            level_forest = int(res_forest[0]["msDS-Behavior-Version"][0])
 
92
            level_domain = int(res_domain[0]["msDS-Behavior-Version"][0])
 
93
            level_domain_mixed = int(res_domain[0]["nTMixedDomain"][0])
 
94
 
 
95
            min_level_dc = int(res_dc_s[0]["msDS-Behavior-Version"][0]) # Init value
 
96
            for msg in res_dc_s:
 
97
                if int(msg["msDS-Behavior-Version"][0]) < min_level_dc:
 
98
                    min_level_dc = int(msg["msDS-Behavior-Version"][0])
 
99
 
 
100
            if level_forest < 0 or level_domain < 0:
 
101
                raise CommandError("Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!")
 
102
            if min_level_dc < 0:
 
103
                raise CommandError("Lowest function level of a DC is invalid. Correct this or reprovision!")
 
104
            if level_forest > level_domain:
 
105
                raise CommandError("Forest function level is higher than the domain level(s). Correct this or reprovision!")
 
106
            if level_domain > min_level_dc:
 
107
                raise CommandError("Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!")
 
108
 
 
109
        except KeyError:
 
110
            raise CommandError("Could not retrieve the actual domain, forest level and/or lowest DC function level!")
 
111
 
 
112
        if subcommand == "show":
 
113
            self.message("Domain and forest function level for domain '%s'" % domain_dn)
 
114
            if level_forest == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 
115
                self.message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2000 (Native). This isn't supported! Please raise!")
 
116
            if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 
117
                self.message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2000 (Native). This isn't supported! Please raise!")
 
118
            if min_level_dc == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 
119
                self.message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
 
120
 
 
121
            self.message("")
 
122
 
 
123
            if level_forest == DS_DOMAIN_FUNCTION_2000:
 
124
                outstr = "2000"
 
125
            elif level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
 
126
                outstr = "2003 with mixed domains/interim (NT4 DC support)"
 
127
            elif level_forest == DS_DOMAIN_FUNCTION_2003:
 
128
                outstr = "2003"
 
129
            elif level_forest == DS_DOMAIN_FUNCTION_2008:
 
130
                outstr = "2008"
 
131
            elif level_forest == DS_DOMAIN_FUNCTION_2008_R2:
 
132
                outstr = "2008 R2"
 
133
            else:
 
134
                outstr = "higher than 2008 R2"
 
135
            self.message("Forest function level: (Windows) " + outstr)
 
136
 
 
137
            if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 
138
                outstr = "2000 mixed (NT4 DC support)"
 
139
            elif level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed == 0:
 
140
                outstr = "2000"
 
141
            elif level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
 
142
                outstr = "2003 with mixed domains/interim (NT4 DC support)"
 
143
            elif level_domain == DS_DOMAIN_FUNCTION_2003:
 
144
                outstr = "2003"
 
145
            elif level_domain == DS_DOMAIN_FUNCTION_2008:
 
146
                outstr = "2008"
 
147
            elif level_domain == DS_DOMAIN_FUNCTION_2008_R2:
 
148
                outstr = "2008 R2"
 
149
            else:
 
150
                outstr = "higher than 2008 R2"
 
151
            self.message("Domain function level: (Windows) " + outstr)
 
152
 
 
153
            if min_level_dc == DS_DOMAIN_FUNCTION_2000:
 
154
                outstr = "2000"
 
155
            elif min_level_dc == DS_DOMAIN_FUNCTION_2003:
 
156
                outstr = "2003"
 
157
            elif min_level_dc == DS_DOMAIN_FUNCTION_2008:
 
158
                outstr = "2008"
 
159
            elif min_level_dc == DS_DOMAIN_FUNCTION_2008_R2:
 
160
                outstr = "2008 R2"
 
161
            else:
 
162
                outstr = "higher than 2008 R2"
 
163
            self.message("Lowest function level of a DC: (Windows) " + outstr)
 
164
 
 
165
        elif subcommand == "raise":
 
166
            msgs = []
 
167
 
 
168
            if domain is not None:
 
169
                if domain == "2003":
 
170
                    new_level_domain = DS_DOMAIN_FUNCTION_2003
 
171
                elif domain == "2008":
 
172
                    new_level_domain = DS_DOMAIN_FUNCTION_2008
 
173
                elif domain == "2008_R2":
 
174
                    new_level_domain = DS_DOMAIN_FUNCTION_2008_R2
 
175
 
 
176
                if new_level_domain <= level_domain and level_domain_mixed == 0:
 
177
                    raise CommandError("Domain function level can't be smaller equal to the actual one!")
 
178
 
 
179
                if new_level_domain > min_level_dc:
 
180
                    raise CommandError("Domain function level can't be higher than the lowest function level of a DC!")
 
181
 
 
182
                # Deactivate mixed/interim domain support
 
183
                if level_domain_mixed != 0:
 
184
                    # Directly on the base DN
 
185
                    m = ldb.Message()
 
186
                    m.dn = ldb.Dn(samdb, domain_dn)
 
187
                    m["nTMixedDomain"] = ldb.MessageElement("0",
 
188
                      ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
 
189
                    samdb.modify(m)
 
190
                    # Under partitions
 
191
                    m = ldb.Message()
 
192
                    m.dn = ldb.Dn(samdb, "CN=" + lp.get("workgroup")
 
193
                      + ",CN=Partitions,CN=Configuration," + domain_dn)
 
194
                    m["nTMixedDomain"] = ldb.MessageElement("0",
 
195
                      ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
 
196
                    try:
 
197
                        samdb.modify(m)
 
198
                    except ldb.LdbError, (enum, emsg):
 
199
                        if enum != ldb.ERR_UNWILLING_TO_PERFORM:
 
200
                            raise
 
201
 
 
202
                # Directly on the base DN
 
203
                m = ldb.Message()
 
204
                m.dn = ldb.Dn(samdb, domain_dn)
 
205
                m["msDS-Behavior-Version"]= ldb.MessageElement(
 
206
                  str(new_level_domain), ldb.FLAG_MOD_REPLACE,
 
207
                          "msDS-Behavior-Version")
 
208
                samdb.modify(m)
 
209
                # Under partitions
 
210
                m = ldb.Message()
 
211
                m.dn = ldb.Dn(samdb, "CN=" + lp.get("workgroup")
 
212
                  + ",CN=Partitions,CN=Configuration," + domain_dn)
 
213
                m["msDS-Behavior-Version"]= ldb.MessageElement(
 
214
                  str(new_level_domain), ldb.FLAG_MOD_REPLACE,
 
215
                          "msDS-Behavior-Version")
 
216
                try:
 
217
                    samdb.modify(m)
 
218
                except ldb.LdbError, (enum, emsg):
 
219
                    if enum != ldb.ERR_UNWILLING_TO_PERFORM:
 
220
                        raise
 
221
 
 
222
                level_domain = new_level_domain
 
223
                msgs.append("Domain function level changed!")
 
224
 
 
225
            if forest is not None:
 
226
                if forest == "2003":
 
227
                    new_level_forest = DS_DOMAIN_FUNCTION_2003
 
228
                elif forest == "2008":
 
229
                    new_level_forest = DS_DOMAIN_FUNCTION_2008
 
230
                elif forest == "2008_R2":
 
231
                    new_level_forest = DS_DOMAIN_FUNCTION_2008_R2
 
232
                if new_level_forest <= level_forest:
 
233
                    raise CommandError("Forest function level can't be smaller equal to the actual one!")
 
234
                if new_level_forest > level_domain:
 
235
                    raise CommandError("Forest function level can't be higher than the domain function level(s). Please raise it/them first!")
 
236
                m = ldb.Message()
 
237
                m.dn = ldb.Dn(samdb, "CN=Partitions,CN=Configuration,"
 
238
                  + domain_dn)
 
239
                m["msDS-Behavior-Version"]= ldb.MessageElement(
 
240
                  str(new_level_forest), ldb.FLAG_MOD_REPLACE,
 
241
                          "msDS-Behavior-Version")
 
242
                samdb.modify(m)
 
243
                msgs.append("Forest function level changed!")
 
244
            msgs.append("All changes applied successfully!")
 
245
            self.message("\n".join(msgs))
 
246
        else:
 
247
            raise CommandError("Wrong argument '%s'!" % subcommand)