From: Tim Beale <timbeale@catalyst.net.nz>
Date: Sun, 8 Jul 2018 21:44:30 +0000 (+1200)
Subject: netcmd: Add sanity-check for invalid domain rename args
X-Git-Tag: tevent-0.9.37~65
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c8f0b88571e6573bea7f20ade2f62c60525ca800;p=thirdparty%2Fsamba.git

netcmd: Add sanity-check for invalid domain rename args

We are suggesting to users that it's safe to run a renamed domain in
parallel with the old backed-up domain. However, this would not be the
case if the user (foolishly) "renames" their domain using the exact same
NetBIOS name or DNS realm.

Using the same DNS realm fails later on (updating the dnsRoot values),
but using the same NetBIOS name actually succeeds. While we can't make
samba tools completely idiot-proof, we can protect users from the most
basic of (potentially unintended) errors with some simple sanity-checks.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py
index 1e8ccfaaba9..cfd97960515 100644
--- a/python/samba/netcmd/domain_backup.py
+++ b/python/samba/netcmd/domain_backup.py
@@ -691,9 +691,8 @@ class cmd_domain_backup_rename(samba.netcmd.Command):
 
         tmpdir = tempfile.mkdtemp(dir=targetdir)
 
-        # Clone and rename the remote server
+        # setup a join-context for cloning the remote server
         lp = sambaopts.get_loadparm()
-        old_domain = lp.get('workgroup')
         creds = credopts.get_credentials(lp)
         include_secrets = not no_secrets
         ctx = DCCloneAndRenameContext(new_base_dn, new_domain_name,
@@ -702,6 +701,19 @@ class cmd_domain_backup_rename(samba.netcmd.Command):
                                       include_secrets=include_secrets,
                                       dns_backend='SAMBA_INTERNAL',
                                       server=server, targetdir=tmpdir)
+
+        # sanity-check we're not "renaming" the domain to the same values
+        old_domain = ctx.domain_name
+        if old_domain == new_domain_name:
+            shutil.rmtree(tmpdir)
+            raise CommandError("Cannot use the current domain NetBIOS name.")
+
+        old_realm = ctx.realm
+        if old_realm == new_dns_realm:
+            shutil.rmtree(tmpdir)
+            raise CommandError("Cannot use the current domain DNS realm.")
+
+        # do the clone/rename
         ctx.do_join()
 
         # get the paths used for the clone, then drop the old samdb connection
@@ -712,7 +724,6 @@ class cmd_domain_backup_rename(samba.netcmd.Command):
         remote_sam = SamDB(url='ldap://' + server, credentials=creds,
                            session_info=system_session(), lp=lp)
         new_sid = get_sid_for_restore(remote_sam)
-        old_realm = remote_sam.domain_dns_name()
 
         # Grab the remote DC's sysvol files and bundle them into a tar file.
         # Note we end up with 2 sysvol dirs - the original domain's files (that
diff --git a/python/samba/tests/domain_backup.py b/python/samba/tests/domain_backup.py
index fad2a93dfb2..2df360f594d 100644
--- a/python/samba/tests/domain_backup.py
+++ b/python/samba/tests/domain_backup.py
@@ -19,7 +19,8 @@ import tarfile
 import os
 import shutil
 from samba.tests.samba_tool.base import SambaToolCmdTest
-from samba.tests import TestCaseInTempDir, env_loadparm, create_test_ou
+from samba.tests import (TestCaseInTempDir, env_loadparm, create_test_ou,
+                         BlackboxProcessError)
 import ldb
 from samba.samdb import SamDB
 from samba.auth import system_session
@@ -398,6 +399,19 @@ class DomainBackupRename(DomainBackupBase):
     def test_backup_restore_no_secrets(self):
         self._test_backup_restore_no_secrets()
 
+    def test_backup_invalid_args(self):
+        """Checks that rename commands with invalid args are rejected"""
+
+        # try a "rename" using the same realm as the DC currently has
+        self.base_cmd = ["domain", "backup", "rename", self.restore_domain,
+                         os.environ["REALM"]]
+        self.assertRaises(BlackboxProcessError, self.create_backup)
+
+        # try a "rename" using the same domain as the DC currently has
+        self.base_cmd = ["domain", "backup", "rename", os.environ["DOMAIN"],
+                         self.restore_realm]
+        self.assertRaises(BlackboxProcessError, self.create_backup)
+
     def add_link(self, attr, source, target):
         m = ldb.Message()
         m.dn = ldb.Dn(self.ldb, source)