summaryrefslogtreecommitdiff
path: root/python/samba/drs_utils.py
AgeCommit message (Collapse)AuthorFilesLines
2025-05-26samba-tool: Filter confidential attributes out of backups made with the ↵Jennifer Sutton1-0/+79
‘--no-secrets’ option Without this change, ‘lab domains’ and backups intended not to contain secrets will still contain confidential information, such as BitLocker recovery data and KDS root keys. Add a new class that filters these attributes out. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26drs_utils: Split process_chunk() out into its own classJennifer Sutton1-26/+66
This makes it easier to add classes with new functionality without having to figure out how to slot them into a linear class hierarchy. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26drs_utils: Check for presence of more_flags attribute directlyJennifer Sutton1-3/+3
This more directly indicates what we are trying to achieve. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python: Make set of seen GUIDs a local variableJennifer Sutton1-3/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python: Correct commentJennifer Sutton1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python: Simplify GetNCChanges call setupJennifer Sutton1-15/+6
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python: Remove unused ‘more_flags’ parameterJennifer Sutton1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python: Tidy up formattingJennifer Sutton1-10/+6
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26drs_utils: Make loop exit condition explicitJennifer Sutton1-4/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26drs_utils: Remove unnecessary qualificationJennifer Sutton1-4/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-15python: use python3 style super statementsRob van der Linde1-5/+2
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-15python: pep257: docstring should use double quotesRob van der Linde1-10/+10
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jun 23 14:51:14 UTC 2023 on atb-devel-224
2022-12-13CVE-2022-37966 selftest: Allow krb5 tests to run against an IP by using the ↵Andrew Bartlett1-2/+10
target_hostname binding string This makes it easier to test against a server that is not accessible via DNS. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-10-04python-drs: Add client-side debug and fallback for GET_ANCAndrew Bartlett1-2/+45
Samba 4.5 and earlier will fail to do GET_ANC correctly and will not replicate non-critical parents of objects with isCriticalSystemObject=TRUE when DRSUAPI_DRS_CRITICAL_ONLY is set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15189 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-06-14libcli:util: Update werror tableJoseph Sutton1-4/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2020-12-09drs_utils: remove unused sendRemoveDsServer()Douglas Bagnall1-23/+0
The only caller of this was `samba-tool domain demote` which stopped using it in 2015 with commit f121173cbf46fe64746d73adf40015c43d5c55fc. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-11-06drs_utils: Avoid invalid dereference of v8 requestsTim Beale1-2/+3
req.more_flags only exists for v10 requests, so we throw an exception if we try to dereference that field on a v8 (or v5) request. Unfortunately, we were checking that we support v10 *after* we had tried to access the more_flags. This patch fixes up the order of the checks. This may be a problem trying to replicate with an older Windows DC (pre-2008R2), and was reported on the samba mailing-list at one point: https://lists.samba.org/archive/samba/2018-June/216541.html Unfortunately this patch doesn't help the overall situation at all (the join will fail because we can't resolve the link target and we can't use GET_TGT). But it now gives you a more meaningful error, i.e. ERROR(runtime): uncaught exception - (8639, "Failed to process 'chunk' of DRS replicated objects: DOS code 0x000021bf" instead of: ERROR(<type 'exceptions.AttributeError'>): uncaught exception - 'drsuapi.DsGetNCChangesRequest8' object has no attribute 'more_flags' Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Tim Beale <timbeale@samba.org> Autobuild-Date(master): Tue Nov 6 07:15:33 CET 2018 on sn-devel-144
2018-11-06drs_utils: Fix some long linesTim Beale1-5/+7
Tweak the code slightly to avoid some 80+ character lines. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-10-17drs_util: Improve memory usage when joining large DBTim Beale1-1/+13
drs_Replicate.replicate() could consume a large amount of memory when replicating a large DB. This is not a leak - the memory gets freed when the function returns (i.e. once the partition is fully replicated). However, while the partition is in the process of being replicated, it accumulates memory for each replication chunk it receives. This can have considerable overhead with 1000s of objects/links in the partition. This was exhausting memory when joining a VM with 1Gb RAM to a DC with 25K users (average ~15 group memberships per user). It seems that by storing a reference to something that's on the ctr's talloc tree, it doesn't free up the memory for each ctr message (until the function actually returns and req is destroyed). With 10K users (and average 15 group memberships per user), .replicate() consumed 211Mb of memory, according to talloc.report_full(). With this patch, it goes down to just the current ctr message (1-2Mb). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Oct 17 08:56:42 CEST 2018 on sn-devel-144
2018-09-06s4/torture/drs: PY3 port for samba4.drs.replica_sync_rodcNoel Power1-1/+1
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett abartlet@samba.org
2018-08-24PEP8: fix E703: statement ends with a semicolonJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E401: multiple imports on one lineJoe Guo1-1/+2
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E302: expected 2 blank lines, found 1Joe Guo1-0/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E128: continuation line under-indented for visual indentJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-07-05drs_utils: Always set the GET_TGT flag for clone renamesTim Beale1-1/+8
The DCCloneAndRenameContext replication was a little inefficient, in that it would essentially replicate the entire DB twice. This was due to resolving the link targets - it finds a target object it doesn't know about, so retries the entire replication again with the GET_TGT flag set this time. Normally, the repl_meta_data code will use the target object's GUID, however, it can't do this for cross-partition links (if it hasn't replicated the target partition yet). The repl_md code can normally detect that the link is a cross-parition link by checking the base-DN, however, this doesn't work in the DCCloneAndRenameContext case because we have renamed the base-DN. This is not a big deal - it just means extra work. However, because the domains being backed up could potentially be quite large, it probably makes sense to just always set the GET_TGT in the rename case and skip this extra work. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-07-03drs_utils: Add infrastructure to support 'clone with rename'Tim Beale1-4/+70
Our end goal is to create a backup clone of a DB, but rename the domain/realm so we can startup the backup DC without interferring with the existing Samba network. The basic strategy to do this is to leverage DRS replication - by renaming the first object in the partition, all subsequent objects will automatically be renamed. This patch adds the infrastructure to do this. I've used object inheritance to handle the special case of renaming the partition objects. This means the domain-rename special case doesn't really pollute the existing DRS replication code. All it needs is a small refactor to create a new 'process_chunk()' function that the new sub-class can then override. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-06-20python/samba: Py2|Py3 compat, fix more missed exception tuple issuesNoel Power1-1/+1
2018-06-10python/drs_utils: fix repeated typoDouglas Bagnall1-2/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Jun 10 21:41:33 CEST 2018 on sn-devel-144
2018-02-15samba python libs: convert 'except X, e' to 'except X as e'Douglas Bagnall1-3/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-09-07drs repl: Only print raw DRS replication traffic at level 9Andrew Bartlett1-1/+1
This can be sensitive even with the passwords still encrypted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13017 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-08-18drs_utils: Add GET_TGT support to 'samba-tool drs replicate --local'Tim Beale1-35/+66
Update drs_Replicate.replicate() so it handles being passed the GET_TGT flag (more_flags). To do this, we need to always use a v10 GetNCChanges request (v8 and v10 are essentially the same except for the more_flags). If the replicate_chunk() call into the C bindings throws an error, check to see whether the error could be fixed by setting the GET_TGT flag, and re-send the request if so. Unfortunately because WERR_DS_DRA_RECYCLED_TARGET isn't documented with the other AD error codes, I've left it hardcoded for now (Microsoft should be fixing up their Docs). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
2017-07-28drs_utils: HWM in 'samba-tool drs replicate --local' always zeroTim Beale1-6/+6
The code to check for the 'repsFrom' highwatermark didn't have any effect because the hwm variable was overwritten (initialized to all zeroes) further down. Using a zero HWM probably wouldn't have impacted functionality because we were still correctly using the uptodatenessvector, which should avoid a full replication. This was introduced in commit e2ba17d26af42974e5d, presumably by accident. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-07-28drs: support sync-forced for 'samba-tool drs replicate --local'Tim Beale1-1/+5
The sync-forced option wasn't being passed into the replication request when the --local option was used. This meant if outbound replication were disabled on the target DC, then the replicate --local command would fail. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-02-23python: Move partial replication logic into drs_utils.pyAndrew Bartlett1-10/+38
This allows us to use this easily from join.py soon Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14drs_utils: use a given highwatermark and uptodateness_vector in replicate()Bob Campbell1-6/+11
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
2017-02-14drs_utils: return number of replicated objects and links in replicate()Bob Campbell1-1/+15
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
2017-02-10getncchanges script: use library code, not copied functions.Douglas Bagnall1-38/+39
These functions were duplicates. To be exact, the diff -ub between what getncchanges had, and what drs_uitls now has is this: |@@ -1,4 +1,5 @@ |-def do_DsBind(drs): |+def drs_DsBind(drs): | '''make a DsBind call, returning the binding handle''' | bind_info = drsuapi.DsBindInfoCtr() | bind_info.length = 28 |@@ -32,7 +33,8 @@ | bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7 | bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT | (info, handle) = drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info) |- return handle |+ |+ return (handle, info.info.supported_extensions) | | | def drs_get_rodc_partial_attribute_set(samdb): |@@ -43,7 +45,7 @@ | attids = [] | | # the exact list of attids we send is quite critical. Note that |- # we do ask for the secret attributes, but set set SPECIAL_SECRET_PROCESSING |+ # we do ask for the secret attributes, but set SPECIAL_SECRET_PROCESSING | # to zero them out | schema_dn = samdb.get_schema_basedn() | res = samdb.search(base=schema_dn, scope=ldb.SCOPE_SUBTREE, |@@ -71,3 +73,4 @@ | partial_attribute_set.attids = attids | partial_attribute_set.num_attids = len(attids) | return partial_attribute_set while the drs_utils code has changed in moving drs_get_rodc_partial_attribute_set() out of the class. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-14python/drs_utils: do not attempt to parse log level, use parsed valueChristian Ambach1-1/+1
The log level parameter can contain debug class specific entries. Do not attempt to parse this as int, but use the values that the debugging system already parsed BUG: https://bugzilla.samba.org/show_bug.cgi?id=9945 Signed-off-by: Christian Ambach <ambi@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-16drs: Send DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP by defaultGarming1-1/+2
This flag is not implemented in Samba, however, on an RODC replicating from Windows, failing to send this flag leaves out group memberships. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-10-14Fix more pep8 issues in code I touched recently.Jelmer Vernooij1-1/+2
Signed-Off-By: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Change-Id: I35f3204bdf5d00b3280d703427ded2fa2163a6f7
2014-10-14Remove remaining instance of pep8 E211 (too many spaces before operator).Jelmer Vernooij1-14/+14
Signed-Off-By: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Change-Id: I9af3bf582bba8fc1094addb12cd0a5ce04406b5b
2013-09-19python/drs: Ensure to pass in the local invocationID during the domain joinAndrew Bartlett1-2/+6
This ensures (and asserts) that we never write an all-zero GUID as an invocationID to the database in replPropertyMetaData. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-03-02Move python modules from source4/scripting/python/ to python/.Jelmer Vernooij1-0/+255
Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Mar 2 03:57:34 CET 2013 on sn-devel-104
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 22:46:09 +0000