1
0
mirror of https://github.com/samba-team/samba.git synced 2025-12-12 12:23:50 +03:00
Commit Graph

160 Commits

Author SHA1 Message Date
Douglas Bagnall
7c94f0c69c py:samdb: add get_linearized to dsdb_dn
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07 23:28:33 +00:00
Douglas Bagnall
c9e814b3a4 dbcheck: make deleted_objects check case-insensitive
While a BinaryDn.prefix is generated in upper-case, and
dsdb.DS_GUID_DELETED_OBJECTS_CONTAINER is upper-case, we can avoid
having to think about that by comparing the actual bytes.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07 23:28:33 +00:00
Douglas Bagnall
62b0d13896 dbcheck: use new dsdb_dn types
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07 23:28:33 +00:00
Douglas Bagnall
8e740bf86d python:samdb: replace dsdb_Dn with stricter types
dsdb_Dn() was a catchall for DN+Binary, DN+String, and plain DNs which
needed to be sorted in a particular way. This meant it treated none of
them exactly right.

For example, a binary dsdb_Dn would be compared on the string
representation of the binary portion, so 'B:2:ff:CN=foo' would not
equal 'B:2:FF:CN=foo', when it should.

It meant a field that expected a binary dsdb_DN would also accept a
plain DN or a string DN, which is never actually allowed.

Also the parsing was a bit dodgy, so a string like 'B:6:ff:CN=foo'
would be accepted, when the length of the binary portion ("ff") is
obviously different from that given ("6").

Here we solve many of the problems by making stricter subclasses but
leaving a compatibility shim in place so that existing code continues
to work.

There is one INCOMPATIBLE change. Previously the `.binary` attribute
of a dsdb_Dn was the hex-string, while now it is the actual binary
data. In the case of StringDn, this means the utf-8 bytes.

This affects dbcheck, which is fixed here (the .prefix assignment now
correctly sets .binary).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07 23:28:33 +00:00
Andrew Bartlett
9a5cc12042 python/samba/samdb: Only do caching of well known DNs in dbcheck
The fact that get_wellknown_dn() returned a cached DN that could
not be modified safely was unexpected, particularly given that
other similar routines did not do that.

The use case given at the time this was written by
Matthieu Patou in 6122acad0f
was dbcheck, so move the cache there, and name it clearly.

dbcheck is the only case that uses this rotuine in an inner
loop.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-02-27 01:11:37 +00:00
Rob van der Linde
ddba4a06bb python: pep257: docstring should use double quotes
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-15 02:54:34 +00:00
Stefan Metzmacher
97e4aab1a6 CVE-2018-14628: python:descriptor: let samba-tool dbcheck fix the nTSecurityDescriptor on CN=Deleted Objects containers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13595

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16 14:39:33 +00:00
Stefan Metzmacher
7058606112 CVE-2018-14628: dbchecker: use get_deletedobjects_descriptor for missing deleted objects container
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13595

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16 14:39:33 +00:00
Andreas Schneider
bb0297dadc python: Fix code spelling
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2023-07-13 05:41:36 +00:00
Andreas Schneider
c837ecf442 python:samba: Fix code spelling
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jun 23 14:51:14 UTC 2023 on atb-devel-224
2023-06-23 14:51:14 +00:00
Joseph Sutton
27a2ee0d1d dbcheck: Fix truncation of warning messages
We are stripping off one too many characters.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-10-05 04:23:33 +00:00
Douglas Bagnall
98c7af0394 py/dbcheck: improve 'please --fix' message
The dbcheck module is used in places other than samba-tool (backup,
provision) where the old 'use --fix' message made no sense. Also,
now that we're not necessarily claiming to fix all errors, we say
how many we think we can.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19 06:10:36 +00:00
Douglas Bagnall
10bcf2bb08 dbcheck: don't recommend --fix for errors we can't fix
and/or won't fix.

I think there are others that should be here.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19 06:10:36 +00:00
Douglas Bagnall
d71258b455 dbcheck: do not crash on empty DN
we had

$ bin/samba-tool dbcheck -H st/rpc_proxy/private/sam.ldb
Checking 202 objects
ERROR(<class 'ValueError'>): uncaught exception - unable to parse dn string
  File "/home/douglasb/src/samba/bin/python/samba/netcmd/__init__.py", line 230, in _run
    return self.run(*args, **kwargs)
  File "/home/douglasb/src/samba/bin/python/samba/netcmd/dbcheck.py", line 173, in run
    error_count = chk.check_database(DN=DN, scope=search_scope,
  File "/home/douglasb/src/samba/bin/python/samba/dbchecker.py", line 255, in check_database
    error_count += self.check_object(object.dn, requested_attrs=attrs)
  File "/home/douglasb/src/samba/bin/python/samba/dbchecker.py", line 2616, in check_object
    expected_dn = ldb.Dn(self.samdb, "RDN=RDN,%s" % (parent_dn))

Now we have:

$ bin/samba-tool dbcheck -H st/rpc_proxy/private/sam.ldb
Checking 202 objects
ERROR: could not handle parent DN '': skipping RDN checks
Please use --fix to fix these errors
Checked 202 objects (1 errors)

which is still not really right, since --fix won't help.

(same with st/s4member/private/sam.ldb).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19 06:10:36 +00:00
Douglas Bagnall
318eb65cb8 py/dbchecker: dbcheck prints bits of colour if asked
Prefixes like ERROR, WARNING, and INFO are given interpretive colours.

This won't change anything until samba-tool decides to ask for colour,
which, who knows, might even be in the next commit.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-19 06:10:36 +00:00
Joseph Sutton
ba54c9cc06 python: Remove unnecessary 'pass' statements
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-10 05:19:34 +00:00
David Mulder
e267cea817 samba-tool: dbcheck search DnsAdmins from wellknown container
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9143
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-22 01:14:37 +00:00
Joseph Sutton
18394daf1e dbcheck: formatting
Reduce the length of some lines to 79 characters or less.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jun 11 08:28:28 UTC 2021 on sn-devel-184
2021-06-11 08:28:28 +00:00
Joseph Sutton
5bf75d01c7 dbcheck: Refactor RID Set check to use free_rid_bounds()
This function provides a simpler method of getting the bounds of the
range of RIDs we want to check. We also now check that the low bound is
less than the high bound for both rIDAllocationPool and
rIDPreviousAllocationPool.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11 07:41:38 +00:00
Andrew Bartlett
4feb353f70 dbcheck: check correct RID set attributes when looking for SID conflicts
The previous code would only work for the first rid set ever given to a DC
because the names are so misleading.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13632

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11 07:41:38 +00:00
Douglas Bagnall
aecb2b779b python: remove all 'from __future__ import print_function'
This made Python 2's print behave like Python 3's print().

In some cases, where we had:

   from __future__ import print_function
   """Intended module documentation..."""

this will have the side effect of making the intended module documentation
work as the actual module documentation (i.e. becoming __doc__), because
it is once again the first statement in the module.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28 03:43:34 +00:00
Andrew Bartlett
da627106cd dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones
These reports (about recently deleted objects)
create concern about a perfectly normal part of DB operation.

We must not operate on objects that are expired or we might reanimate them,
but we must fix "Deleted Objects" if it is wrong (mostly it is set as being
deleted in 9999, but in alpha19 we got this wrong).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14593

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Feb  3 05:29:11 UTC 2021 on sn-devel-184
2021-02-03 05:29:11 +00:00
Douglas Bagnall
9bf9b99808 dbcheck: clarify check_object userparams
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
8337144389 dbcheck: check_object/userparams: use variable for clarity
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
22447a5159 dbcheck: reduce useless use of str(attrname)
it's already a string!

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
0dd736ff33 dbcheck: better disambiguate 'attrs'
We had too many things called 'attrs'; now we have just one, but we
don't want it to look like it is *the* one.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
206a028e1e dbcheck: split out attr calculations from check_object()
check_object is too long!

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
43530f087d dbcheck: add a helper function for attr tracking
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
b21287c2f4 dbcheck: do not add duplicate attrs for checking
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
6b4ff45805 dbcheck: check_object() caches of lower case attr names
The construct `'name' in map(str.lower, attrs)` is doubly inefficient,
because not only is it running the lower() function too often, it is
searching linearly in a temporary iterator for membership.

So we make a set, and use that.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
25a94fa474 dbcheck: make rIDSetReferences attr check case-insensitve
Yes, it looks inefficient, but that's because it is just trying to fit
in. Very soon we will fix it it properly.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-15 14:32:43 +00:00
Douglas Bagnall
cc9ff79d86 dbcheck: err_normalise-mismatch_replace: no msg if no error
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Wed Dec  9 17:04:23 UTC 2020 on sn-devel-184
2020-12-09 17:04:23 +00:00
Douglas Bagnall
f1be8813b0 dbcheck: fix doc for err_normalise_mismatch*
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
c28a3dd6d2 dbcheck: fix doc for do_rename()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
17fb635532 dbcheck: remove unused fix_incorrect_deleted_objects flag
This was introduced in db15993401
but not actually referenced then or since.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
0aec5b930d dbcheck: improve some duplicate doc strings
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
99cdb2191e dbcheck: drop py2 support from dump_attr_values()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
713117401c dbcheck: don't try to stringify values list twice
dump_attr_values already turns it into a comma separated list.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
081d12de52 dbcheck: add docstring for err_odd_userParameters
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
9fabe3aafd dbcheck: fix documentation for err_doubled_userParameters
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
c7b39f1cea dbcheck: fix documentation and typo for err_utf_userParameters
pseudo, not psudo.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
fa0350374d dbcheck: fix documentation for err_base64_userParameters
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
Douglas Bagnall
3afd594273 dbcheck: fix documentation for err_duplicate_values
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-12-09 16:00:39 +00:00
David Mulder
85d2ff2f00 python: Move dsdb_Dn to samdb
The import dsdb needed for dsdb_Dn causes import
errors when trying to import get_bytes/get_string
in some places.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-10-02 13:29:35 +00:00
Andrew Bartlett
05228c4e07 dbcheck: Allow a dangling forward link outside our known NCs
If we do not have the NC of the target object we can not be really sure
that the object is redundent and so we want to keep it for now
and not (as happened until now) break the dbcheck run made during the
replication stage of a "samba-tool domain backup rename".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14450

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-07-29 03:19:02 +00:00
Douglas Bagnall
5a078bc961 dbcheck: omit unused argument in err_wrong_default_sd
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>
2020-07-17 07:17:39 +00:00
Björn Jacke
6e91c52bbb python/samba/dbchecker.py: typo fixes
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-10-31 00:43:36 +00:00
Stefan Metzmacher
2ef79a4c1d dbcheck: fallback to the default tombstoneLifetime of 180 days
If a domain was provisioned by Windows 2000 this value is missing in the
database.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13967

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue May 28 08:32:10 UTC 2019 on sn-devel-184
2019-05-28 08:32:09 +00:00
Stefan Metzmacher
261ef9d5b6 dbcheck: fix the err_empty_attribute() check
ldb.bytes('') == '' is never True in python3,
we nee ldb.bytes('') == b'' in order to
check that on attribute has an empty value,
that seems to work for python2 and python3.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13843

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Noel Power <npower@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar 21 18:15:20 UTC 2019 on sn-devel-144
2019-03-21 18:15:20 +00:00
Stefan Metzmacher
dd6f0dad21 dbcheck: use the str() value of the "name" attribute
We do the same with the rdn attribute value
and we need the same logic on both in order to
check they are the same.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13816

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2019-03-21 16:42:19 +00:00