path: root/python/samba/netcmd/fsmo.py

# Changes a FSMO role owner
#
# Copyright Nadezhda Ivanova 2009
# Copyright Jelmer Vernooij 2009
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

import samba
import samba.getopt as options
import ldb
from ldb import LdbError
from samba.dcerpc import drsuapi, misc
from samba.auth import system_session
import samba.drs_utils
from samba.netcmd import (
    Command,
    CommandError,
    SuperCommand,
    Option,
)
from samba.samdb import SamDB


def get_fsmo_roleowner(samdb, roledn, role):
    """Gets the owner of an FSMO role

    :param roledn: The DN of the FSMO role
    :param role: The FSMO role
    """
    try:
        res = samdb.search(roledn,
                           scope=ldb.SCOPE_BASE, attrs=["fSMORoleOwner"])
    except LdbError as e7:
        (num, msg) = e7.args
        if num == ldb.ERR_NO_SUCH_OBJECT:
            raise CommandError("The '%s' role is not present in this domain" % role)
        raise

    if 'fSMORoleOwner' in res[0]:
        master_owner = (ldb.Dn(samdb, res[0]["fSMORoleOwner"][0].decode('utf8')))
    else:
        master_owner = None

    return master_owner


def transfer_dns_role(outf, sambaopts, credopts, role, samdb):
    """Transfer dns FSMO role. """

    if role == "domaindns":
        domain_dn = samdb.domain_dn()
        role_object = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
    elif role == "forestdns":
        forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
        role_object = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn

    new_host_dns_name = samdb.host_dns_name()

    res = samdb.search(role_object,
                       attrs=["fSMORoleOwner"],
                       scope=ldb.SCOPE_BASE,
                       controls=["extended_dn:1:1"])

    if 'fSMORoleOwner' in res[0]:
        try:
            master_guid = str(misc.GUID(ldb.Dn(samdb,
                                               res[0]['fSMORoleOwner'][0].decode('utf8'))
                                        .get_extended_component('GUID')))
            master_owner = str(ldb.Dn(samdb, res[0]['fSMORoleOwner'][0].decode('utf8')))
        except LdbError as e3:
            (num, msg) = e3.args
            raise CommandError("No GUID found in naming master DN %s : %s \n" %
                               (res[0]['fSMORoleOwner'][0], msg))
    else:
        outf.write("* The '%s' role does not have an FSMO roleowner\n" % role)
        return False

    if role == "domaindns":
        master_dns_name = '%s._msdcs.%s' % (master_guid,
                                            samdb.domain_dns_name())
        new_dns_name = '%s._msdcs.%s' % (samdb.get_ntds_GUID(),
                                         samdb.domain_dns_name())
    elif role == "forestdns":
        master_dns_name = '%s._msdcs.%s' % (master_guid,
                                            samdb.forest_dns_name())
        new_dns_name = '%s._msdcs.%s' % (samdb.get_ntds_GUID(),
                                         samdb.forest_dns_name())

    new_owner = samdb.get_dsServiceName()

    if master_dns_name != new_dns_name:
        lp = sambaopts.get_loadparm()
        creds = credopts.get_credentials(lp, fallback_machine=True)
        samdb = SamDB(url="ldap://%s" % (master_dns_name),
                      session_info=system_session(),
                      credentials=creds, lp=lp)

        m = ldb.Message()
        m.dn = ldb.Dn(samdb, role_object)
        m["fSMORoleOwner_Del"] = ldb.MessageElement(master_owner,
                                                    ldb.FLAG_MOD_DELETE,
                                                    "fSMORoleOwner")
        m["fSMORoleOwner_Add"] = ldb.MessageElement(new_owner,
                                                    ldb.FLAG_MOD_ADD,
                                                    "fSMORoleOwner")
        try:
            samdb.modify(m)
        except LdbError as e5:
            (num, msg) = e5.args
            raise CommandError("Failed to add role '%s': %s" % (role, msg))

        try:
            connection = samba.drs_utils.drsuapi_connect(new_host_dns_name,
                                                         lp, creds)
        except samba.drs_utils.drsException as e:
            raise CommandError("Drsuapi Connect failed", e)

        try:
            drsuapi_connection = connection[0]
            drsuapi_handle = connection[1]
            req_options = drsuapi.DRSUAPI_DRS_WRIT_REP
            NC = role_object[18:]
            samba.drs_utils.sendDsReplicaSync(drsuapi_connection,
                                              drsuapi_handle,
                                              master_guid,
                                              NC, req_options)
        except samba.drs_utils.drsException as estr:
            raise CommandError("Replication failed", estr)

        outf.write("FSMO transfer of '%s' role successful\n" % role)
        return True
    else:
        outf.write("This DC already has the '%s' FSMO role\n" % role)
        return False


def transfer_role(outf, role, samdb):
    """Transfer standard FSMO role. """

    domain_dn = samdb.domain_dn()
    rid_dn = "CN=RID Manager$,CN=System," + domain_dn
    naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
    infrastructure_dn = "CN=Infrastructure," + domain_dn
    schema_dn = str(samdb.get_schema_basedn())
    new_owner = ldb.Dn(samdb, samdb.get_dsServiceName())
    m = ldb.Message()
    m.dn = ldb.Dn(samdb, "")
    if role == "rid":
        master_owner = get_fsmo_roleowner(samdb, rid_dn, role)
        m["becomeRidMaster"] = ldb.MessageElement(
            "1", ldb.FLAG_MOD_REPLACE,
            "becomeRidMaster")
    elif role == "pdc":
        master_owner = get_fsmo_roleowner(samdb, domain_dn, role)

        res = samdb.search(domain_dn,
                           scope=ldb.SCOPE_BASE, attrs=["objectSid"])
        assert len(res) == 1
        sid = res[0]["objectSid"][0]
        m["becomePdc"] = ldb.MessageElement(
            sid, ldb.FLAG_MOD_REPLACE,
            "becomePdc")
    elif role == "naming":
        master_owner = get_fsmo_roleowner(samdb, naming_dn, role)
        m["becomeDomainMaster"] = ldb.MessageElement(
            "1", ldb.FLAG_MOD_REPLACE,
            "becomeDomainMaster")
    elif role == "infrastructure":
        master_owner = get_fsmo_roleowner(samdb, infrastructure_dn, role)
        m["becomeInfrastructureMaster"] = ldb.MessageElement(
            "1", ldb.FLAG_MOD_REPLACE,
            "becomeInfrastructureMaster")
    elif role == "schema":
        master_owner = get_fsmo_roleowner(samdb, schema_dn, role)
        m["becomeSchemaMaster"] = ldb.MessageElement(
            "1", ldb.FLAG_MOD_REPLACE,
            "becomeSchemaMaster")
    else:
        raise CommandError("Invalid FSMO role.")

    if master_owner is None:
        outf.write("Cannot transfer, no DC assigned to the %s role.  Try 'seize' instead\n" % role)
        return False

    if master_owner != new_owner:
        try:
            samdb.modify(m)
        except LdbError as e6:
            (num, msg) = e6.args
            raise CommandError("Transfer of '%s' role failed: %s" %
                               (role, msg))

        outf.write("FSMO transfer of '%s' role successful\n" % role)
        return True
    else:
        outf.write("This DC already has the '%s' FSMO role\n" % role)
        return False


class cmd_fsmo_seize(Command):
    """Seize the role."""

    synopsis = "%prog [options]"

    takes_optiongroups = {
        "sambaopts": options.SambaOptions,
        "credopts": options.CredentialsOptions,
        "versionopts": options.VersionOptions,
    }

    takes_options = [
        Option("-H", "--URL", help="LDB URL for database or target server",
               type=str, metavar="URL", dest="H"),
        Option("--force",
               help="Force seizing of role without attempting to transfer.",
               action="store_true"),
        Option("--role", type="choice", choices=["rid", "pdc", "infrastructure",
                                                 "schema", "naming", "domaindns", "forestdns", "all"],
               help="""The FSMO role to seize or transfer.\n
rid=RidAllocationMasterRole\n
schema=SchemaMasterRole\n
pdc=PdcEmulationMasterRole\n
naming=DomainNamingMasterRole\n
infrastructure=InfrastructureMasterRole\n
domaindns=DomainDnsZonesMasterRole\n
forestdns=ForestDnsZonesMasterRole\n
all=all of the above\n
You must provide an Admin user and password."""),
    ]

    takes_args = []

    def seize_role(self, role, samdb, force):
        """Seize standard fsmo role. """

        serviceName = samdb.get_dsServiceName()
        domain_dn = samdb.domain_dn()
        self.infrastructure_dn = "CN=Infrastructure," + domain_dn
        self.naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
        self.schema_dn = str(samdb.get_schema_basedn())
        self.rid_dn = "CN=RID Manager$,CN=System," + domain_dn

        m = ldb.Message()
        if role == "rid":
            m.dn = ldb.Dn(samdb, self.rid_dn)
        elif role == "pdc":
            m.dn = ldb.Dn(samdb, domain_dn)
        elif role == "naming":
            m.dn = ldb.Dn(samdb, self.naming_dn)
        elif role == "infrastructure":
            m.dn = ldb.Dn(samdb, self.infrastructure_dn)
        elif role == "schema":
            m.dn = ldb.Dn(samdb, self.schema_dn)
        else:
            raise CommandError("Invalid FSMO role.")
        # first try to transfer to avoid problem if the owner is still active
        seize = False
        master_owner = get_fsmo_roleowner(samdb, m.dn, role)
        # if there is a different owner
        if master_owner is not None:
            # if there is a different owner
            if master_owner != serviceName:
                # if --force isn't given, attempt transfer
                if force is None:
                    self.message("Attempting transfer...")
                    try:
                        transfer_role(self.outf, role, samdb)
                    except:
                        # transfer failed, use the big axe...
                        seize = True
                        self.message("Transfer unsuccessful, seizing...")
                    else:
                        self.message("Transfer successful, not seizing role")
                        return True
            else:
                self.outf.write("This DC already has the '%s' FSMO role\n" %
                                role)
                return False
        else:
            seize = True

        if force is not None or seize:
            self.message("Seizing %s FSMO role..." % role)
            m["fSMORoleOwner"] = ldb.MessageElement(
                serviceName, ldb.FLAG_MOD_REPLACE,
                "fSMORoleOwner")

            samdb.transaction_start()
            try:
                samdb.modify(m)
                if role == "rid":
                    # We may need to allocate the initial RID Set
                    samdb.create_own_rid_set()

            except LdbError as e1:
                (num, msg) = e1.args
                if role == "rid" and num == ldb.ERR_ENTRY_ALREADY_EXISTS:

                    # Try again without the RID Set allocation
                    # (normal).  We have to manage the transaction as
                    # we do not have nested transactions and creating
                    # a RID set touches multiple objects. :-(
                    samdb.transaction_cancel()
                    samdb.transaction_start()
                    try:
                        samdb.modify(m)
                    except LdbError as e:
                        (num, msg) = e.args
                        samdb.transaction_cancel()
                        raise CommandError("Failed to seize '%s' role: %s" %
                                           (role, msg))

                else:
                    samdb.transaction_cancel()
                    raise CommandError("Failed to seize '%s' role: %s" %
                                       (role, msg))
            samdb.transaction_commit()
            self.outf.write("FSMO seize of '%s' role successful\n" % role)

            return True

    def seize_dns_role(self, role, samdb, credopts, sambaopts,
                       versionopts, force):
        """Seize DNS FSMO role. """

        serviceName = samdb.get_dsServiceName()
        domain_dn = samdb.domain_dn()
        forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
        self.domaindns_dn = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
        self.forestdns_dn = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn

        m = ldb.Message()
        if role == "domaindns":
            m.dn = ldb.Dn(samdb, self.domaindns_dn)
        elif role == "forestdns":
            m.dn = ldb.Dn(samdb, self.forestdns_dn)
        else:
            raise CommandError("Invalid FSMO role.")
        # first try to transfer to avoid problem if the owner is still active
        seize = False
        master_owner = get_fsmo_roleowner(samdb, m.dn, role)
        if master_owner is not None:
            # if there is a different owner
            if master_owner != serviceName:
                # if --force isn't given, attempt transfer
                if force is None:
                    self.message("Attempting transfer...")
                    try:
                        transfer_dns_role(self.outf, sambaopts, credopts, role,
                                          samdb)
                    except:
                        # transfer failed, use the big axe...
                        seize = True
                        self.message("Transfer unsuccessful, seizing...")
                    else:
                        self.message("Transfer successful, not seizing role\n")
                        return True
            else:
                self.outf.write("This DC already has the '%s' FSMO role\n" %
                                role)
                return False
        else:
            seize = True

        if force is not None or seize:
            self.message("Seizing %s FSMO role..." % role)
            m["fSMORoleOwner"] = ldb.MessageElement(
                serviceName, ldb.FLAG_MOD_REPLACE,
                "fSMORoleOwner")
            try:
                samdb.modify(m)
            except LdbError as e2:
                (num, msg) = e2.args
                raise CommandError("Failed to seize '%s' role: %s" %
                                   (role, msg))
            self.outf.write("FSMO seize of '%s' role successful\n" % role)
            return True

    def run(self, force=None, H=None, role=None,
            credopts=None, sambaopts=None, versionopts=None):

        lp = sambaopts.get_loadparm()
        creds = credopts.get_credentials(lp, fallback_machine=True)

        samdb = SamDB(url=H, session_info=system_session(),
                      credentials=creds, lp=lp)

        if role == "all":
            self.seize_role("rid", samdb, force)
            self.seize_role("pdc", samdb, force)
            self.seize_role("naming", samdb, force)
            self.seize_role("infrastructure", samdb, force)
            self.seize_role("schema", samdb, force)
            self.seize_dns_role("domaindns", samdb, credopts, sambaopts,
                                versionopts, force)
            self.seize_dns_role("forestdns", samdb, credopts, sambaopts,
                                versionopts, force)
        else:
            if role == "domaindns" or role == "forestdns":
                self.seize_dns_role(role, samdb, credopts, sambaopts,
                                    versionopts, force)
            else:
                self.seize_role(role, samdb, force)


class cmd_fsmo_show(Command):
    """Show the roles."""

    synopsis = "%prog [options]"

    takes_optiongroups = {
        "sambaopts": options.SambaOptions,
        "credopts": options.CredentialsOptions,
        "versionopts": options.VersionOptions,
    }

    takes_options = [
        Option("-H", "--URL", help="LDB URL for database or target server",
               type=str, metavar="URL", dest="H"),
    ]

    takes_args = []

    def run(self, H=None, credopts=None, sambaopts=None, versionopts=None):
        lp = sambaopts.get_loadparm()
        creds = credopts.get_credentials(lp, fallback_machine=True)

        samdb = SamDB(url=H, session_info=system_session(),
                      credentials=creds, lp=lp)

        domain_dn = samdb.domain_dn()
        forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
        infrastructure_dn = "CN=Infrastructure," + domain_dn
        naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
        schema_dn = samdb.get_schema_basedn()
        rid_dn = "CN=RID Manager$,CN=System," + domain_dn
        domaindns_dn = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
        forestdns_dn = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn

        masters = [(schema_dn, "schema", "SchemaMasterRole"),
                   (infrastructure_dn, "infrastructure", "InfrastructureMasterRole"),
                   (rid_dn, "rid", "RidAllocationMasterRole"),
                   (domain_dn, "pdc", "PdcEmulationMasterRole"),
                   (naming_dn, "naming", "DomainNamingMasterRole"),
                   (domaindns_dn, "domaindns", "DomainDnsZonesMasterRole"),
                   (forestdns_dn, "forestdns", "ForestDnsZonesMasterRole"),
                   ]

        for master in masters:
            (dn, short_name, long_name) = master
            try:
                master = get_fsmo_roleowner(samdb, dn, short_name)
                if master is not None:
                    self.message("%s owner: %s" % (long_name, str(master)))
                else:
                    self.message("%s has no current owner" % (long_name))
            except CommandError as e:
                self.message("%s: * %s" % (long_name, e.message))


class cmd_fsmo_transfer(Command):
    """Transfer the role."""

    synopsis = "%prog [options]"

    takes_optiongroups = {
        "sambaopts": options.SambaOptions,
        "credopts": options.CredentialsOptions,
        "versionopts": options.VersionOptions,
    }

    takes_options = [
        Option("-H", "--URL", help="LDB URL for database or target server",
               type=str, metavar="URL", dest="H"),
        Option("--role", type="choice", choices=["rid", "pdc", "infrastructure",
                                                 "schema", "naming", "domaindns", "forestdns", "all"],
               help="""The FSMO role to seize or transfer.\n
rid=RidAllocationMasterRole\n
schema=SchemaMasterRole\n
pdc=PdcEmulationMasterRole\n
naming=DomainNamingMasterRole\n
infrastructure=InfrastructureMasterRole\n
domaindns=DomainDnsZonesMasterRole\n
forestdns=ForestDnsZonesMasterRole\n
all=all of the above\n
You must provide an Admin user and password."""),
    ]

    takes_args = []

    def run(self, force=None, H=None, role=None,
            credopts=None, sambaopts=None, versionopts=None):

        lp = sambaopts.get_loadparm()
        creds = credopts.get_credentials(lp, fallback_machine=True)

        samdb = SamDB(url=H, session_info=system_session(),
                      credentials=creds, lp=lp)

        if role == "all":
            transfer_role(self.outf, "rid", samdb)
            transfer_role(self.outf, "pdc", samdb)
            transfer_role(self.outf, "naming", samdb)
            transfer_role(self.outf, "infrastructure", samdb)
            transfer_role(self.outf, "schema", samdb)
            transfer_dns_role(self.outf, sambaopts, credopts,
                              "domaindns", samdb)
            transfer_dns_role(self.outf, sambaopts, credopts, "forestdns",
                              samdb)
        else:
            if role == "domaindns" or role == "forestdns":
                transfer_dns_role(self.outf, sambaopts, credopts, role, samdb)
            else:
                transfer_role(self.outf, role, samdb)


class cmd_fsmo(SuperCommand):
    """Flexible Single Master Operations (FSMO) roles management."""

    subcommands = {}
    subcommands["seize"] = cmd_fsmo_seize()
    subcommands["show"] = cmd_fsmo_show()
    subcommands["transfer"] = cmd_fsmo_transfer()