netcmd: Add sanity-check for invalid domain rename args

We are suggesting to users that it's safe to run a renamed domain in
parallel with the old backed-up domain. However, this would not be the
case if the user (foolishly) "renames" their domain using the exact same
NetBIOS name or DNS realm.

Using the same DNS realm fails later on (updating the dnsRoot values),
but using the same NetBIOS name actually succeeds. While we can't make
samba tools completely idiot-proof, we can protect users from the most
basic of (potentially unintended) errors with some simple sanity-checks.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py
index 1e8ccfaaba9ca1a5e8de5fd76a24e764cccb9fbd..cfd97960515ba57a7780bc36793e4216ad58423f 100644 (file)
--- a/python/samba/netcmd/domain_backup.py
+++ b/python/samba/netcmd/domain_backup.py
@@ -691,9 +691,8 @@ class cmd_domain_backup_rename(samba.netcmd.Command):
 
         tmpdir = tempfile.mkdtemp(dir=targetdir)
 
-        # Clone and rename the remote server
+        # setup a join-context for cloning the remote server
         lp = sambaopts.get_loadparm()
-        old_domain = lp.get('workgroup')
         creds = credopts.get_credentials(lp)
         include_secrets = not no_secrets
         ctx = DCCloneAndRenameContext(new_base_dn, new_domain_name,
@@ -702,6 +701,19 @@ class cmd_domain_backup_rename(samba.netcmd.Command):
                                       include_secrets=include_secrets,
                                       dns_backend='SAMBA_INTERNAL',
                                       server=server, targetdir=tmpdir)
+
+        # sanity-check we're not "renaming" the domain to the same values
+        old_domain = ctx.domain_name
+        if old_domain == new_domain_name:
+            shutil.rmtree(tmpdir)
+            raise CommandError("Cannot use the current domain NetBIOS name.")
+
+        old_realm = ctx.realm
+        if old_realm == new_dns_realm:
+            shutil.rmtree(tmpdir)
+            raise CommandError("Cannot use the current domain DNS realm.")
+
+        # do the clone/rename
         ctx.do_join()
 
         # get the paths used for the clone, then drop the old samdb connection
@@ -712,7 +724,6 @@ class cmd_domain_backup_rename(samba.netcmd.Command):
         remote_sam = SamDB(url='ldap://' + server, credentials=creds,
                            session_info=system_session(), lp=lp)
         new_sid = get_sid_for_restore(remote_sam)
-        old_realm = remote_sam.domain_dns_name()
 
         # Grab the remote DC's sysvol files and bundle them into a tar file.
         # Note we end up with 2 sysvol dirs - the original domain's files (that

diff --git a/python/samba/tests/domain_backup.py b/python/samba/tests/domain_backup.py
index fad2a93dfb2569444d8a3db8369fd3aefe984320..2df360f594de573c4ade956d7e160a1522f75507 100644 (file)
--- a/python/samba/tests/domain_backup.py
+++ b/python/samba/tests/domain_backup.py
@@ -19,7 +19,8 @@ import tarfile
 import os
 import shutil
 from samba.tests.samba_tool.base import SambaToolCmdTest
-from samba.tests import TestCaseInTempDir, env_loadparm, create_test_ou
+from samba.tests import (TestCaseInTempDir, env_loadparm, create_test_ou,
+                         BlackboxProcessError)
 import ldb
 from samba.samdb import SamDB
 from samba.auth import system_session
@@ -398,6 +399,19 @@ class DomainBackupRename(DomainBackupBase):
     def test_backup_restore_no_secrets(self):
         self._test_backup_restore_no_secrets()
 
+    def test_backup_invalid_args(self):
+        """Checks that rename commands with invalid args are rejected"""
+
+        # try a "rename" using the same realm as the DC currently has
+        self.base_cmd = ["domain", "backup", "rename", self.restore_domain,
+                         os.environ["REALM"]]
+        self.assertRaises(BlackboxProcessError, self.create_backup)
+
+        # try a "rename" using the same domain as the DC currently has
+        self.base_cmd = ["domain", "backup", "rename", os.environ["DOMAIN"],
+                         self.restore_realm]
+        self.assertRaises(BlackboxProcessError, self.create_backup)
+
     def add_link(self, attr, source, target):
         m = ldb.Message()
         m.dn = ldb.Dn(self.ldb, source)