summaryrefslogtreecommitdiff
path: root/python/samba/dbchecker.py
AgeCommit message (Collapse)AuthorFilesLines
2025-08-07py:samdb: add get_linearized to dsdb_dnDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07dbcheck: make deleted_objects check case-insensitiveDouglas Bagnall1-3/+4
While a BinaryDn.prefix is generated in upper-case, and dsdb.DS_GUID_DELETED_OBJECTS_CONTAINER is upper-case, we can avoid having to think about that by comparing the actual bytes. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07dbcheck: use new dsdb_dn typesDouglas Bagnall1-11/+12
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07python:samdb: replace dsdb_Dn with stricter typesDouglas Bagnall1-1/+0
dsdb_Dn() was a catchall for DN+Binary, DN+String, and plain DNs which needed to be sorted in a particular way. This meant it treated none of them exactly right. For example, a binary dsdb_Dn would be compared on the string representation of the binary portion, so 'B:2:ff:CN=foo' would not equal 'B:2:FF:CN=foo', when it should. It meant a field that expected a binary dsdb_DN would also accept a plain DN or a string DN, which is never actually allowed. Also the parsing was a bit dodgy, so a string like 'B:6:ff:CN=foo' would be accepted, when the length of the binary portion ("ff") is obviously different from that given ("6"). Here we solve many of the problems by making stricter subclasses but leaving a compatibility shim in place so that existing code continues to work. There is one INCOMPATIBLE change. Previously the `.binary` attribute of a dsdb_Dn was the hex-string, while now it is the actual binary data. In the case of StringDn, this means the utf-8 bytes. This affects dbcheck, which is fixed here (the .prefix assignment now correctly sets .binary). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2024-02-27python/samba/samdb: Only do caching of well known DNs in dbcheckAndrew Bartlett1-8/+25
The fact that get_wellknown_dn() returned a cached DN that could not be modified safely was unexpected, particularly given that other similar routines did not do that. The use case given at the time this was written by Matthieu Patou in 6122acad0f1a7bc23b6f58862c16968e13da979d was dbcheck, so move the cache there, and name it clearly. dbcheck is the only case that uses this rotuine in an inner loop. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2023-12-15python: pep257: docstring should use double quotesRob van der Linde1-45/+45
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16CVE-2018-14628: python:descriptor: let samba-tool dbcheck fix the ↵Stefan Metzmacher1-2/+8
nTSecurityDescriptor on CN=Deleted Objects containers BUG: https://bugzilla.samba.org/show_bug.cgi?id=13595 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16CVE-2018-14628: dbchecker: use get_deletedobjects_descriptor for missing ↵Stefan Metzmacher1-3/+14
deleted objects container BUG: https://bugzilla.samba.org/show_bug.cgi?id=13595 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-13python: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2023-06-23python:samba: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jun 23 14:51:14 UTC 2023 on atb-devel-224
2022-10-05dbcheck: Fix truncation of warning messagesJoseph Sutton1-1/+1
We are stripping off one too many characters. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19py/dbcheck: improve 'please --fix' messageDouglas Bagnall1-1/+2
The dbcheck module is used in places other than samba-tool (backup, provision) where the old 'use --fix' message made no sense. Also, now that we're not necessarily claiming to fix all errors, we say how many we think we can. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19dbcheck: don't recommend --fix for errors we can't fixDouglas Bagnall1-12/+19
and/or won't fix. I think there are others that should be here. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19dbcheck: do not crash on empty DNDouglas Bagnall1-11/+20
we had $ bin/samba-tool dbcheck -H st/rpc_proxy/private/sam.ldb Checking 202 objects ERROR(<class 'ValueError'>): uncaught exception - unable to parse dn string File "/home/douglasb/src/samba/bin/python/samba/netcmd/__init__.py", line 230, in _run return self.run(*args, **kwargs) File "/home/douglasb/src/samba/bin/python/samba/netcmd/dbcheck.py", line 173, in run error_count = chk.check_database(DN=DN, scope=search_scope, File "/home/douglasb/src/samba/bin/python/samba/dbchecker.py", line 255, in check_database error_count += self.check_object(object.dn, requested_attrs=attrs) File "/home/douglasb/src/samba/bin/python/samba/dbchecker.py", line 2616, in check_object expected_dn = ldb.Dn(self.samdb, "RDN=RDN,%s" % (parent_dn)) Now we have: $ bin/samba-tool dbcheck -H st/rpc_proxy/private/sam.ldb Checking 202 objects ERROR: could not handle parent DN '': skipping RDN checks Please use --fix to fix these errors Checked 202 objects (1 errors) which is still not really right, since --fix won't help. (same with st/s4member/private/sam.ldb). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19py/dbchecker: dbcheck prints bits of colour if askedDouglas Bagnall1-4/+21
Prefixes like ERROR, WARNING, and INFO are given interpretive colours. This won't change anything until samba-tool decides to ask for colour, which, who knows, might even be in the next commit. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-10python: Remove unnecessary 'pass' statementsJoseph Sutton1-2/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-06-22samba-tool: dbcheck search DnsAdmins from wellknown containerDavid Mulder1-1/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9143 Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-11dbcheck: formattingJoseph Sutton1-12/+22
Reduce the length of some lines to 79 characters or less. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Jun 11 08:28:28 UTC 2021 on sn-devel-184
2021-06-11dbcheck: Refactor RID Set check to use free_rid_bounds()Joseph Sutton1-28/+24
This function provides a simpler method of getting the bounds of the range of RIDs we want to check. We also now check that the low bound is less than the high bound for both rIDAllocationPool and rIDPreviousAllocationPool. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11dbcheck: check correct RID set attributes when looking for SID conflictsAndrew Bartlett1-8/+34
The previous code would only work for the first rid set ever given to a DC because the names are so misleading. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13632 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall1-1/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-02-03dbcheck: Check Deleted Objects and reduce noise in reports about expired ↵Andrew Bartlett1-1/+24
tombstones These reports (about recently deleted objects) create concern about a perfectly normal part of DB operation. We must not operate on objects that are expired or we might reanimate them, but we must fix "Deleted Objects" if it is wrong (mostly it is set as being deleted in 9999, but in alpha19 we got this wrong). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14593 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Feb 3 05:29:11 UTC 2021 on sn-devel-184
2020-12-15dbcheck: clarify check_object userparamsDouglas Bagnall1-6/+17
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: check_object/userparams: use variable for clarityDouglas Bagnall1-6/+7
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: reduce useless use of str(attrname)Douglas Bagnall1-12/+12
it's already a string! Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: better disambiguate 'attrs'Douglas Bagnall1-7/+6
We had too many things called 'attrs'; now we have just one, but we don't want it to look like it is *the* one. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: split out attr calculations from check_object()Douglas Bagnall1-5/+18
check_object is too long! Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: add a helper function for attr trackingDouglas Bagnall1-6/+8
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: do not add duplicate attrs for checkingDouglas Bagnall1-3/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: check_object() caches of lower case attr namesDouglas Bagnall1-12/+19
The construct `'name' in map(str.lower, attrs)` is doubly inefficient, because not only is it running the lower() function too often, it is searching linearly in a temporary iterator for membership. So we make a set, and use that. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-15dbcheck: make rIDSetReferences attr check case-insensitveDouglas Bagnall1-1/+1
Yes, it looks inefficient, but that's because it is just trying to fit in. Very soon we will fix it it properly. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: err_normalise-mismatch_replace: no msg if no errorDouglas Bagnall1-2/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Wed Dec 9 17:04:23 UTC 2020 on sn-devel-184
2020-12-09dbcheck: fix doc for err_normalise_mismatch*Douglas Bagnall1-2/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: fix doc for do_rename()Douglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: remove unused fix_incorrect_deleted_objects flagDouglas Bagnall1-1/+0
This was introduced in db15993401f927fd2fcea1687c4155dce2272aa8 but not actually referenced then or since. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: improve some duplicate doc stringsDouglas Bagnall1-2/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: drop py2 support from dump_attr_values()Douglas Bagnall1-14/+9
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: don't try to stringify values list twiceDouglas Bagnall1-1/+2
dump_attr_values already turns it into a comma separated list. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: add docstring for err_odd_userParametersDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: fix documentation for err_doubled_userParametersDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: fix documentation and typo for err_utf_userParametersDouglas Bagnall1-2/+3
pseudo, not psudo. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: fix documentation for err_base64_userParametersDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-12-09dbcheck: fix documentation for err_duplicate_valuesDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-10-02python: Move dsdb_Dn to samdbDavid Mulder1-1/+1
The import dsdb needed for dsdb_Dn causes import errors when trying to import get_bytes/get_string in some places. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-07-29dbcheck: Allow a dangling forward link outside our known NCsAndrew Bartlett1-1/+23
If we do not have the NC of the target object we can not be really sure that the object is redundent and so we want to keep it for now and not (as happened until now) break the dbcheck run made during the replication stage of a "samba-tool domain backup rename". BUG: https://bugzilla.samba.org/show_bug.cgi?id=14450 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-07-17dbcheck: omit unused argument in err_wrong_default_sdDouglas Bagnall1-2/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2019-10-31python/samba/dbchecker.py: typo fixesBjörn Jacke1-4/+4
Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-05-28dbcheck: fallback to the default tombstoneLifetime of 180 daysStefan Metzmacher1-1/+4
If a domain was provisioned by Windows 2000 this value is missing in the database. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13967 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue May 28 08:32:10 UTC 2019 on sn-devel-184
2019-03-21dbcheck: fix the err_empty_attribute() checkStefan Metzmacher1-1/+1
ldb.bytes('') == '' is never True in python3, we nee ldb.bytes('') == b'' in order to check that on attribute has an empty value, that seems to work for python2 and python3. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13843 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Mar 21 18:15:20 UTC 2019 on sn-devel-144
2019-03-21dbcheck: use the str() value of the "name" attributeStefan Metzmacher1-1/+1
We do the same with the rdn attribute value and we need the same logic on both in order to check they are the same. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13816 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Noel Power <npower@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 21:40:43 +0000