summaryrefslogtreecommitdiff
path: root/python
Commit message (Collapse)AuthorAgeFilesLines
* tests/posixacl: Test with and without filling in the unix_tokenAndrew Bartlett2018-07-121-0/+25
| | | | | | | | | | | Sadly the unix token cannot be created without a running winbindd, which is not available during provision and a domain restore. (Internally in smbd a backup API via passdb is used, but this is not connected to this function at this time) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* python: Add samba.auth.session_info_fill_unix()Andrew Bartlett2018-07-121-0/+11
| | | | | | | | | This fills in the unix portions of the token needed by smbd and the pysmbd bindings Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Joe Guo <joeg@catalyst.net.nz> Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* selftest: Add tests for samba.auth.admin_session()Andrew Bartlett2018-07-121-4/+37
| | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Pair-programmed-with: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* tests/posixacl: derive a new testcase to run same tests with sessionJoe Guo2018-07-121-20/+72
| | | | | | | | | | | | 1. existing tests still run with session_info=None 2. new class override `get_session_info` to return a session, so same set of tests will run again, but with session. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: move setUp and tearDown to topJoe Guo2018-07-121-16/+14
| | | | | | | | | | Make it clear to find out what we have in test. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: rm duplicated testJoe Guo2018-07-121-17/+0
| | | | | | | | | | | | | | There are 2 copy of `test_setposixacl_getposixacl`, this patch removed the first copy, which was overwritten by the second one. They are 99% the same except in the last line a_perm is 6 vs 7, and 7 is the correct number. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: use assertRaises to simplify codeJoe Guo2018-07-121-12/+4
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: remove unused importsJoe Guo2018-07-121-3/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: define global ACL to make code DRYJoe Guo2018-07-121-11/+12
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: define global DOM_SID to make code DRYJoe Guo2018-07-121-13/+15
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests/posixacl: rm commented codeJoe Guo2018-07-121-8/+0
| | | | | | | | | | The example is already in code, no need to keep it here. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* provision/setsysvolacl: create helper function to simplify codeJoe Guo2018-07-121-11/+10
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* provision/setsysvolacl: build session_info and pass down to setntaclJoe Guo2018-07-121-3/+17
| | | | | | | | | | Get the admin session info, and pass it down to setntacl. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ntacls: add session_info arg to setntacl and pass down to set_nt_acl apiJoe Guo2018-07-121-4/+35
| | | | | | | | | | | Then underneath code can reuse the authentication info in session to improve performance. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ntacls: reuse predefined SECURITY_SECINFO_FLAGSJoe Guo2018-07-121-3/+3
| | | | | | | | | | | Use predefined SECURITY_SECINFO_FLAGS to replace bitwise or operations on flag list. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* python/tests: check setting values on dnsRecord attributesBob Campbell2018-07-121-2/+32
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12451 Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests dns: dns_base.py remove flake8 warningsGary Lockyer2018-07-121-4/+8
| | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests dns: dns.py remove flake8 warningsGary Lockyer2018-07-121-167/+346
| | | | | | | | Remove flake8 warnings from the code, this highlighted the issue with test_update_add_null_char_rpc_to_dns fixed in the preceding commit. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests dns: fix rpc null byte testGary Lockyer2018-07-121-10/+19
| | | | | | | | Fix update_add_null_char_rpc_to_dns so that the test matches the name. It was not passing the embedded null to the rpc call. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dns: static recordsAaron Haslett2018-07-121-0/+36
| | | | | | | | | | Modifies bind9 and internal dns to match windows static records behaviour. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dns: update tool changed for scavengingAaron Haslett2018-07-121-5/+13
| | | | | | | | | | | | Now that scavenging is implemented, the DNS update tool needs to be changed so that it always updates every name required by the DC. Otherwise, the records might be scavenged. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dns: dns record scavenging function (without task)Aaron Haslett2018-07-121-4/+45
| | | | | | | | | | | | DNS record scavenging function with testing. The logic of the custom match rule in previous commit is inverted so that calculations using zone properties can be taken out of the function's inner loop. Periodic task to come. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dns: Use ldb.SCOPE_SUBTREE in ldap_get_records() routine in tests/dns.pyAaron Haslett2018-07-121-2/+4
| | | | | | | | | | | | | | DNS records have the odd property that the DN can be reliably determined by the name only, so we do not need a subtree search. However by using a subtree search under the zone we can without trapping exceptions confirm if the record exists or not in the tests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dns: custom match rule for DNS records to be tombstonedAaron Haslett2018-07-121-0/+46
| | | | | | | | | | | | | A custom match rule for records to be tombstoned by the scavenging process. Needed because DNS records are a multi-valued attribute on name records, so without a custom match rule we'd have entire zones into memory to search for expired records. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* dns: server side implementation of record agingAaron Haslett2018-07-121-0/+1
| | | | | | | | | | | Code for retrieving aging properties from a zone and using them for timestamp setting logic during processing of DNS requests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rpc dns: reset dword aging related zone propertiesAaron Haslett2018-07-121-0/+4
| | | | | | | | | | This allows a user to set zone properties relevant to DNS record aging over RPC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dns: record aging testsAaron Haslett2018-07-122-14/+208
| | | | | | | | | | | | First basic DNS record aging tests. These check that we can turn aging on and off, and that timestamps are written on DNS add and update calls, but not RPC calls. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10812 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/tests: make the test_assoc_group_fail2() test more resilient against ↵Stefan Metzmacher2018-07-101-0/+3
| | | | | | | | | | | | | | | | timing On a busy system [e]poll() on the server will mark both the old connection fd and also the listening fd as readable. epoll() returns the events in order, so the server processes the disconnect first. With poll() we don't have an order of the events and the server is likely to process the connect before the disconnect. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* netcmd: Add sanity-check for invalid domain rename argsTim Beale2018-07-102-4/+29
| | | | | | | | | | | | | | | | We are suggesting to users that it's safe to run a renamed domain in parallel with the old backed-up domain. However, this would not be the case if the user (foolishly) "renames" their domain using the exact same NetBIOS name or DNS realm. Using the same DNS realm fails later on (updating the dnsRoot values), but using the same NetBIOS name actually succeeds. While we can't make samba tools completely idiot-proof, we can protect users from the most basic of (potentially unintended) errors with some simple sanity-checks. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Add brief log file of what the backup actually containsTim Beale2018-07-101-0/+25
| | | | | | | | | | | | | | | | | | | | | | | There are now several different permutations of backup file that can be created (i.e. online, rename, with/without secrets). Hopefully the admin users would organize their backup files sensibly, but it can't hurt to keep track of what the backup-file actually contains in a simple human-readable file within the backup tar. E.g. We really don't want backups with secrets-included and secrets-excluded getting mixed up. Recording the DC used to make the domain backup may be useful in the event of a catastrophic failure of the domain, e.g. DC replication may have been broken for some time prior to the failure. Recording the samba-tool version string may also be useful if there are ever any backwards-compatibility issues introduced to the backup files. The intention is to say we only support restoring a backup with the same version of samba-tool that actually created the backup, however, it'd be polite to users to actually record that version somewhere. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Add no-secrets option to domain backupsTim Beale2018-07-102-9/+82
| | | | | | | | | | | | | | | | | | | | By default we include all the domain's secrets in the backup file. This patch adds an extra option to exclude these secrets. In particular, this is for the use case of creating a lab domain (where you might not feel comfortable with the secrets for all your users being present). Mostly this just involves passing the correct option to the join/clone. I've also made sure that a password is also set for the Admin user (samba does seem to start up without one set, but this behaviour is closer to what happens during a provision). The tests have been extended to use the new option, and to assert that secrets are/aren't included as expected for some of the builtin testenv users. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Use dbcheck to fix DB problems introduced by restore itselfTim Beale2018-07-051-0/+29
| | | | | | | | | | | | | | | As part of the restore process, we remove all the old DCs from the DB. However, this introduces some dbcheck errors - there are some DN attributes and one-way links that reference the deleted objects that need fixing up. To resolve this, we can run dbcheck as part of the restore process. This problem affects both renames and plain restores. The dbcheck.sh test didn't spot this problem because it fixes this type of DB error first, before it checks the DB. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Add new tests for backup-rename commandTim Beale2018-07-051-1/+121
| | | | | | | | | | | | | | Extend the existing 'backup online' tests to also test the domain rename case. This mostly involves some extra assertions that the restored DB has been modified appropriatelt (i.e. domain NetBIOS name is updated, etc). I've also added an extra test case that creates a few objects and links and specifically asserts that they get renamed appropriately. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Extend 'backup restore' command to handle renamed domainsTim Beale2018-07-053-8/+61
| | | | | | | | | | | | | | | | When restoring a renamed domain backup, we need to register the new realm's DNS zone. We do this in the restore step because we don't know the new server's IP/hostname in the backup step. Because we may have removed the old realm's DNS entries in the rename step, the remove_dc() code may fail to find the expected DNS entries for the DC's domain (the DCs' dnsHostname still maps to the old DNS realm). We just needed to adjust remove_dns_references() as it was getting a slightly different error code. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Add 'samba-tool domain backup rename' commandTim Beale2018-07-051-1/+217
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new command that takes a clone of the domain's DB, and renames the domain as well. (We rename the domain during the clone because it's easier to implement - the DRS code handles most of the renaming for us, as it applies the received replication chunks). The new option is similar to an online backup, except we also do the following: - use the new DCCloneAndRenameContext code to clone the DB - run dbcheck to fix up any residual old DNs (mostly objectCategory references) - rename the domain's netBIOSName - add dnsRoot objects for the new DNS realm - by default, remove the old realm's DNS objects (optional) - add an extra backupRename marker to the backed-up DB. In the restore code, if the backup was renamed, then we need to register the new domain's DNS zone at that point (we only know the new DC's host IP at the restore stage). Note that the backup will contain the old DC entries that still use the old dnsHostname, but these DC entries will all be removed during the restore, and a new DC will be added with the correct dnsHostname. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Tweak the backup online tests so they're genericTim Beale2018-07-051-15/+42
| | | | | | | | | | | | | | | | Update backup-online tests to be more generic. We can then re-use the common framework for other types of backups (offline, rename), and just change what's specific to those particular cases. This change includes asserting the restored backup's domain/realm are correct, which we weren't doing previously but makes sense. The new 'return samdb' is for convenience, so that child classes can easily extend the checks we run over the restored DB. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* drs_utils: Always set the GET_TGT flag for clone renamesTim Beale2018-07-051-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | The DCCloneAndRenameContext replication was a little inefficient, in that it would essentially replicate the entire DB twice. This was due to resolving the link targets - it finds a target object it doesn't know about, so retries the entire replication again with the GET_TGT flag set this time. Normally, the repl_meta_data code will use the target object's GUID, however, it can't do this for cross-partition links (if it hasn't replicated the target partition yet). The repl_md code can normally detect that the link is a cross-parition link by checking the base-DN, however, this doesn't work in the DCCloneAndRenameContext case because we have renamed the base-DN. This is not a big deal - it just means extra work. However, because the domains being backed up could potentially be quite large, it probably makes sense to just always set the GET_TGT in the rename case and skip this extra work. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* join: Add more framework for renaming a domainTim Beale2018-07-051-3/+97
| | | | | | | | | | | | | | | | Add a DCCloneContext subclass which will rename the DB objects as they get cloned. This uses the drs_ReplicateRenamer class added to drs_utils in an earlier patch. Where the drs_Replicate object currently gets created has been split out into a simple new function, which we can then override in the rename case. The other important difference is overriding the provision step, so that we use the new domain-DN/realm when setting up the initial SAM DB (and smb.conf, secrets.ldb, etc). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool drs showrepl: correctly report failing repsFromAndrew Bartlett2018-07-041-1/+1
| | | | | | | | | | Hopefully this fixes the flapping test. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Jul 4 04:43:39 CEST 2018 on sn-devel-144
* drs_utils: Add infrastructure to support 'clone with rename'Tim Beale2018-07-031-4/+70
| | | | | | | | | | | | | | | | | | | Our end goal is to create a backup clone of a DB, but rename the domain/realm so we can startup the backup DC without interferring with the existing Samba network. The basic strategy to do this is to leverage DRS replication - by renaming the first object in the partition, all subsequent objects will automatically be renamed. This patch adds the infrastructure to do this. I've used object inheritance to handle the special case of renaming the partition objects. This means the domain-rename special case doesn't really pollute the existing DRS replication code. All it needs is a small refactor to create a new 'process_chunk()' function that the new sub-class can then override. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* selftest: Add testenv for testing backup/restoreTim Beale2018-07-031-1/+3
| | | | | | | | | | | | | | | | | | | This adds a new testenv for testing that a DC created using the samba-tool backup/restore can actually be started up. This actually requires 2 new testenvs: 1. A 'backupfromdc' that solely exists to make a online backup of. 2. A 'restoredc' which takes the backup, and then uses the backup file to do a restore, which we then start the DC based on. The backupfromdc is just a plain vanilla AD DC. We use a separate test env purely for this purpose, because the restoredc will use the same domain (and so using an existing testenv would potentially interfere with existing test cases). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* tests: Add tests for the domain backup online/restore commandsAaron Haslett2018-07-031-0/+307
| | | | | | | Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* netcmd: domain backup restore commandAaron Haslett2018-07-032-42/+235
| | | | | | | | | | | Add a command option that restores a backup file. This is only intended for recovering from a catastrophic failure of the domain. The old domain DCs are removed from the DB and a new DC is added. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* netcmd: domain backup online commandAaron Haslett2018-07-033-0/+232
| | | | | | | | | | | This adds a samba-tool command that can be run against a remote DC to produce a backup-file for the current domain. The backup stores similar info to what a new DC would get if it joined the network. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* join: Remove unnecessary clone_only flagTim Beale2018-07-031-5/+7
| | | | | | | | | | | | | | | | | | | | For the clone-only case, we have been avoiding a block of code in the DCJoinContext's __init__(). The main reason we do this is because the netbios_name is None for clones, and this block of code tries to derive a bunch of values based on the netbios_name (otherwise, a few lines into this block, it tries to do NoneType.lower(), which Python doesn't like very much). This code is not particularly clone-specific - it is just never going to work if the netbios_name is None. So we can change the conditional check, which allows us to get rid of the clone_only flag. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Tue Jul 3 08:12:10 CEST 2018 on sn-devel-144
* join: Refactor clone_only case to simplify codeTim Beale2018-07-031-49/+75
| | | | | | | | | | | | | | | | | | | | | Currently for DC clones, we create a regular DCJoinContext, se a 'clone_only' flag, and then make lots of special checks for this flag throughout the code. Instead, we can use inheritance to create a DCCloneContext sub-class, and put the specialization there. This means we can remove all the 'clone_only' checks from the code. The only 2 methods that really differ are do_join() and join_finalize(), and these don't share much code at all. (To avoid duplication, I split the first part of do_join() into a new build_nc_lists() function, but this is a pretty trivial code move). We still pass the clone_only flag into the __init__() as there's still one case where we want to avoid doing work in the case of the clone. For clarity, I'll refactor this in a subsequent patch. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* join: Rename dc_join() so it looks like an objectTim Beale2018-07-032-18/+24
| | | | | | | | | dc_join() is creating an object, but it currently looks like it's just a function call. Rename it to look more object-like. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* join: Pipe through dns_backend option for clonesAaron Haslett2018-07-031-2/+3
| | | | | | | | | Allow join_clone() calls to specify a dns_backend parameter for the new cloned DB. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* provision: Small refactor to host-IP logicTim Beale2018-07-031-23/+31
| | | | | | | | | | Split out the code that determines the host-IP of the new server into separate functions. This will allow us to re-use the same logic in the backup/restore case. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dbchecker: Fixing up incorrect DNs wasn't workingTim Beale2018-07-031-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dbcheck would fail to fix up attributes where the extended DN's GUID is correct, but the DN itself is incorrect. The code failed attempting to remove the old/incorrect DN, e.g. NOTE: old (due to rename or delete) DN string component for objectCategory in object CN=alice,CN=Users,DC=samba,DC=example,DC=com - <GUID=7bfdf9d8-62f9-420c-8a71-e3d3e931c91e>; CN=Person,CN=Schema,CN=Configuration,DC=samba,DC=bad,DC=com Change DN to <GUID=7bfdf9d8-62f9-420c-8a71-e3d3e931c91e>; CN=Person,CN=Schema,CN=Configuration,DC=samba,DC=example,DC=com? [y/N/all/none] y Failed to fix old DN string on attribute objectCategory : (16, "attribute 'objectCategory': no matching attribute value while deleting attribute on 'CN=alice,CN=Users,DC=samba,DC=example,DC=com'") The problem was the LDB message specified the value to delete with its full DN, including the GUID. The LDB code then helpfully corrected this value on the way through, so that the DN got updated to reflect the correct DN (i.e. 'DC=example,DC=com') of the object matching that GUID, rather than the incorrect DN (i.e. 'DC=bad,DC=com') that we were trying to remove. Because the requested value and the existing DB value didn't match, the operation failed. We can avoid this problem by passing down just the DN (not the extended DN) of the value we want to delete. Without the GUID portion of the DN, the LDB code will no longer try to correct it on the way through, and the dbcheck operation will succeed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13495 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status