a
     ’{aŽ ã                   @   sè   d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
 d dl	mZ d dlmZmZ d d	l	mZ d d
lmZ d dl	mZ d dlmZmZ d dlmZmZ d dlmZ d dlmZ dd„ ZG dd„ deƒZdS )é    )Úprint_functionN)Ú	b64decode)Údsdb)Úcommon)Úmisc)Údrsuapi)Ú
ndr_unpackÚndr_pack)Údrsblobs)Údsdb_Dn)Úsecurity)Úget_wellknown_sdsÚget_diff_sds)Úsystem_sessionÚadmin_session)ÚCommandError)Úget_fsmo_roleownerc              	   C   sR   d}| D ]D}t |ƒrd| }z|t|ƒ }W q tyJ   |t|ƒ }Y q0 q|S )NÚ ú,)ÚlenÚstrÚUnicodeDecodeErrorÚrepr)ÚvalsÚresultÚvalue© r   ú1/usr/lib/python3/dist-packages/samba/dbchecker.pyÚdump_attr_values/   s    r   c                	   @   s`  e Zd ZdZd“dd„Zdejddfdd„Zdd	„ Zd
d„ Z	d”dd„Z
dd„ Zdd„ Zd•dd„Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#d$„ Zd–d%d&„Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Zd1d2„ Zd3d4„ Zd5d6„ Zd7d8„ Zd9d:„ Z d—d;d<„Z!d=d>„ Z"d?d@„ Z#dAdB„ Z$dCdD„ Z%dEdF„ Z&dGdH„ Z'dIdJ„ Z(dKdL„ Z)dMdN„ Z*dOdP„ Z+dQdR„ Z,dSdT„ Z-dUdV„ Z.dWdX„ Z/dYdZ„ Z0d[d\„ Z1d]d^„ Z2d_d`„ Z3dadb„ Z4dcdd„ Z5dedf„ Z6dgdh„ Z7didj„ Z8dkdl„ Z9dmdn„ Z:dodp„ Z;dqdr„ Z<dsdt„ Z=dudv„ Z>dwdx„ Z?dydz„ Z@d{d|„ ZAd}d~„ ZBdd€„ ZCdd‚„ ZDdƒd„„ ZEd…d†„ ZFd‡dˆ„ ZGd‰dŠ„ ZHd˜d‹dŒ„ZIddŽ„ ZJdd„ ZKd‘d’„ ZLdS )™Údbcheckzcheck a SAM database for errorsNFc                 C   sD  || _ d | _|p|| _|| _|| _|| _|| _d| _d| _d| _	d| _
d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _tƒ | _d| _d| _d| _d| _d| _ d| _!d| _"d| _#d| _$d| _%d| _&d| _'d| _(d| _)d| _*d| _+d| _,d| _-|| _.|	| _/|
| _0d| _1d| _2|| _3t4 5|d| 6¡  ¡| _7t4 5|d| 8¡  ¡| _9| :¡ | _;t4 5|d| 6¡  ¡| _<t4 5|| =¡ ¡| _>i | _?t@| j ƒ| _Ad| _Bd| _Cd| _Dd| _Ed| _FtGƒ | _Hi | _Ii | _JzF|jKd| 6¡  t4jLdgd}tMtNjO|d d d ƒ}tP|ƒ| jJd	< W n@ t4jQy` } z$|jR\}}|t4jSkrL‚ W Y d }~n
d }~0 0 tTƒ | _UtVd | W¡ ƒ| _X| j jK| j>t4jLd
dgd}d
|d v r²|d d
 | _Yn$d|d v rÐ|d d | _Ynd | _Y| j jKdt4jLdgd}g | _Zg | _[g | _\z|d d | _]W n& t^y$   Y n t_y6   Y n0 | j]D ]h}z0| j  `t4 5| j | ad¡¡tbjc¡}| jZ d|¡ W n0 t^y¢   | j[ dt4 5| j | ad¡¡¡ Y n0 q>d| j  e¡  }d| j  f¡  }| j jKt4jgddg| j  h¡ d| d}ti|ƒdkr| j\ dt4 5| j |¡|d f¡ | j jKt4jgddg| j  h¡ d| d}ti|ƒdkrd| j\ dt4 5| j |¡|d f¡ t4 5| j d| j  6¡  ¡}tj| j |dƒ}t4 5| j | j  =¡ ¡|kr¬d| _knd| _k| j jKt4 5| j | j  l¡ ¡t4jLdgd}t4 5| j |d d d  ad¡¡| _m| j jK| jmt4jLdgd}d|d v rDt4 5| j |d d d  ad¡¡| _nnd | _nd| j  8¡  o¡  }|jK|t4jLddgd}d|d v r˜tp|d d d ƒ| _qnd| _qg | _rg | _szT| j jKt4jLdd d!gd"}d |d v rà|d d  | _rd!|d v rü|d d! | _sW n@ t4jQy> } z$|jR\}}|t4jSkr*‚ W Y d }~n
d }~0 0 d S )#NFr   zCN=Infrastructure,zCN=Partitions,%szCN=RID Manager$,CN=System,zCN=DnsAdmins,CN=Users,%sZ	objectSid©ÚbaseÚscopeÚattrsZ	DnsAdminszmsDS-hasMasterNCsZhasMasterNCsr   ZnamingContextsÚutf8zDC=DomainDnsZones,%szDC=ForestDnsZones,%súmsDS-NC-Replica-LocationsúmsDS-NC-RO-Replica-Locationsz$(&(objectClass=crossRef)(ncName=%s)))r"   r#   r!   Ú
expressioné   ZridTZserverReferenceÚrIDSetReferencesz1CN=Directory Service,CN=Windows NT,CN=Services,%sz(objectClass=nTDSService)ÚtombstoneLifetime)r!   r"   r'   r#   é´   z@SAMBA_DSDBÚcompatibleFeaturesÚrequiredFeatures)r"   r!   r#   )tÚsamdbZdict_oid_nameÚsamdb_schemaÚverboseÚfixÚyesÚquietÚremove_all_unknown_attributesÚremove_all_empty_attributesÚfix_all_normalisationÚfix_all_duplicatesÚfix_all_DN_GUIDsÚfix_all_binary_dnÚ#remove_implausible_deleted_DN_linksÚ!remove_plausible_deleted_DN_linksZ$fix_all_string_dn_component_mismatchZ"fix_all_GUID_dn_component_mismatchZ!fix_all_SID_dn_component_mismatchÚ fix_all_SID_dn_component_missingÚ(fix_all_old_dn_string_component_mismatchÚfix_all_metadataÚfix_time_metadataÚfix_undead_linked_attributesÚfix_all_missing_backlinksÚfix_all_orphaned_backlinksÚfix_all_missing_forward_linksÚdictÚduplicate_link_cacheÚrecover_all_forward_linksÚfix_rmd_flagsÚfix_ntsecuritydescriptorÚ$fix_ntsecuritydescriptor_owner_groupÚseize_fsmo_roleÚmove_to_lost_and_foundÚfix_instancetypeÚ"fix_replmetadata_zero_invocationidÚ fix_replmetadata_duplicate_attidÚfix_replmetadata_wrong_attidÚfix_replmetadata_unsorted_attidÚfix_deleted_deleted_objectsZfix_incorrect_deleted_objectsÚfix_dnÚfix_base64_userparametersÚfix_utf8_userparametersÚfix_doubled_userparametersÚfix_sid_rid_set_conflictÚquick_membership_checksÚreset_well_known_aclsÚcheck_expired_tombstonesÚexpired_tombstonesÚreset_all_well_known_aclsÚin_transactionÚldbÚDnÚ	domain_dnÚinfrastructure_dnZget_config_basednÚ	naming_dnZget_schema_basednÚ	schema_dnÚrid_dnÚget_dsServiceNameÚntds_dsaÚclass_schemaIDGUIDr   Úwellknown_sdsÚfix_all_missing_objectclassÚfix_missing_deleted_objectsÚfix_replica_locationsÚfix_missing_rid_set_masterÚfix_changes_after_deletion_bugÚsetÚdn_setÚlink_id_cacheÚname_mapÚsearchÚ
SCOPE_BASEr   r   Údom_sidr   ÚLdbErrorÚargsÚERR_NO_SUCH_OBJECTr   Úsystem_session_infor   Úget_domain_sidÚadmin_session_infoÚ	write_ncsÚdeleted_objects_containersÚncs_lacking_deleted_containersÚdns_partitionsZncsÚKeyErrorÚ
IndexErrorÚget_wellknown_dnÚdecoder   Ú!DS_GUID_DELETED_OBJECTS_CONTAINERÚappendZget_default_basednÚget_root_basednZSCOPE_ONELEVELZget_partitions_dnr   r   Úis_rid_masterZget_serverNameÚserver_ref_dnÚ
rid_set_dnÚget_linearizedÚintr*   r,   r-   )Úselfr.   r/   r0   r1   r2   r3   r\   rW   rX   rY   ÚresZdnsadmins_sidZe5ÚenumÚestrÚncÚdnZdomaindns_zoneZforestdns_zoneZdomainZforestZfsmo_dnZ
rid_masterZntds_service_dnZe6r   r   r   Ú__init__=   sF   

ÿ

ÿ&
ý
ýÿ"
ÿ$ÿý
ÿþ
zdbcheck.__init__c                 C   sÐ   | j j||dg|d}|  dt|ƒ ¡ d}||  ¡ 7 }tƒ | _|D ]*}| j t	|j
ƒ¡ || j|j
|d7 }qD|du r„||  ¡ 7 }| jdkrž|  d| j ¡ |dkr¶| js¶|  d¡ |  d	t|ƒ|f ¡ |S )
z>perform a database check, returning the number of errors foundr   ©r!   r"   r#   ÚcontrolszChecking %u objectsr   )r#   Nz†NOTICE: found %d expired tombstones, 'samba' will remove them daily, 'samba-tool domain tombstones expunge' would do that immediately.z$Please use --fix to fix these errorszChecked %u objects (%u errors))r.   rq   Úreportr   Ú check_deleted_objects_containersrm   Úattribute_or_class_idsrn   Úaddr   r   Úcheck_objectÚcheck_rootdserZ   r1   )rŠ   ZDNr"   r’   r#   r‹   Úerror_countÚobjectr   r   r   Úcheck_databaseö   s$    
ü
zdbcheck.check_databasec                 C   s   d}| j D ]î}|| jkrq
|d7 }|  d| ¡ |  d| d¡sDq
t | jd¡}| |¡ d}z`| jj|tj	g g d¢d	}t
|ƒdkr¾|d j d
¡}t | jdtt |¡ƒ ¡}| |¡ W n\ tjy } z@|j\}}	|tjkrên|  d|	 ¡ W Y d}~ dS W Y d}~n
d}~0 0 |durŒz| j ||g d¢¡ W nJ tjyŠ }
 z.|
j\}}	|  d|||	f ¡ W Y d}
~
 dS d}
~
0 0 | jj|tj	dgg d¢d	}t
|ƒdkrÊ|  d| ¡  dS |d d }g }d}|D ]P}t| j| d¡tjƒ}|  |¡r"|  d| ¡ |j d
¡}| t|ƒ¡ qâ|durRdtt |¡ƒ }n dtj }| d||f ¡ d}| jjd||f ddgd t ¡ }t | jt|d d ƒ¡|_t |tjd¡|d< | j|dgd| ddrî|  d | ¡ | j  |¡ q
|S )!z`This function only fixes conflicts on the Deleted Objects
        containers, not the attributesr   r(   z=ERROR: NC %s lacks a reference to a Deleted Objects containerz-Fix missing Deleted Objects container for %s?ri   zCN=Deleted ObjectsN)úshow_deleted:1úextended_dn:1:1úshow_recycled:1úreveal_internals:0r‘   ÚGUIDzCN=Deleted Objects\0ACNF:%sz<Couldn't check for conflicting Deleted Objects container: %s)rœ   úrelax:0rž   z;Couldn't move old Deleted Objects placeholder: %s to %s: %sZwellKnownObjects)rœ   úextended_dn:0rž   rŸ   z(wellKnownObjects was not found for NC %sr$   z7wellKnownObjects had duplicate Deleted Objects value %sz
objectGUID: %szB:32:%sú%s:%sr   z¾dn: %s
objectClass: top
objectClass: container
description: Container for deleted objects
isDeleted: TRUE
isCriticalSystemObject: TRUE
showInAdvancedViewOnly: TRUE
systemFlags: -1946157056%sr¡   úprovision:0©r’   r   z"NC %s lacks Deleted Objects WKGUIDF©ÚvalidatezAdded %s well known guid link)!r|   rb   r“   Úconfirm_allr]   r^   r.   Zadd_baserq   rr   r   r   Úget_extended_componentr   r   r    rt   ru   rv   Úrenamer   r   r   ÚDSDB_SYNTAX_BINARY_DNÚis_deleted_objects_dnrƒ   r‚   Zadd_ldifÚMessageÚMessageElementÚFLAG_MOD_REPLACEÚ	do_modifyr{   )rŠ   r™   rŽ   r   Zconflict_dnr‹   ÚguidZe2rŒ   r   Ze1ZwkoZlistwkoZproposed_objectguidÚoÚdsdb_dnZguid_suffixZ
wko_prefixÚdeltar   r   r   r”     s’    

ÿÿ

&

þ

ùø
þ
þz(dbcheck.check_deleted_objects_containersc                 C   s   | j st|ƒ dS )z#print a message unless quiet is setN)r3   Úprint)rŠ   Úmsgr   r   r   r“   y  s    zdbcheck.reportc                 C   s0   | j s
dS | jr| jS | jr d}tj|||dS )zconfirm a changeFT©ÚforcedÚ	allow_all)r1   r3   r2   r   Úconfirm)rŠ   r¶   r¹   r¸   r   r   r   rº   ~  s    zdbcheck.confirmc                 C   s„   | j s
dS t| |ƒdkrdS t| |ƒdkr0d}n| j}| jr@|S tj||dd}|dkrht| |dƒ dS |dkr€t| |dƒ dS |S )z(confirm a change with support for "all" FÚNONEZALLTr·   )r1   Úgetattrr2   r3   r   rº   Úsetattr)rŠ   r¶   Zall_attrr¸   Úcr   r   r   r¨   Š  s"    zdbcheck.confirm_allc              
   C   sŒ   | j r|  d| ¡ z$|dtj g }| jj||d W nN ty† } z6| jr^td||f ƒ‚|  d||f ¡ W Y d}~dS d}~0 0 dS )z&delete dn with optional verbose outputzdelete DN %súlocal_oid:%s:0r¥   ú%s : %sNFT)	r0   r“   r   ÚDSDB_CONTROL_DBCHECKr.   ÚdeleteÚ	Exceptionr\   r   )rŠ   r   r’   r¶   Úerrr   r   r   Ú	do_deleteŸ  s    zdbcheck.do_deleteTc              
   C   s¤   |dt j g }| jr:|  | j |tj¡¡ |  d| ¡ z| jj|||d W nN t	yž } z6| j
rvtd||f ƒ‚|  d||f ¡ W Y d}~dS d}~0 0 dS )ú-perform a modify with optional verbose outputr¿   zcontrols: %r)r’   r§   rÀ   NFT)r   rÁ   r0   r“   r.   Z
write_ldifr]   ZCHANGETYPE_MODIFYÚmodifyrÃ   r\   r   )rŠ   Úmr’   r¶   r§   rÄ   r   r   r   r°   ­  s    zdbcheck.do_modifyc              
   C   s¨   | j r&|  dt|ƒt|ƒt|ƒf ¡ z.|| }|dtj g }| jj|||d W nN ty¢ } z6| jrzt	d||f ƒ‚|  d||f ¡ W Y d}~dS d}~0 0 dS )rÆ   zDdn: %s
changeType: modrdn
newrdn: %s
deleteOldRdn: 1
newSuperior: %sr¿   r¥   rÀ   NFT)
r0   r“   r   r   rÁ   r.   rª   rÃ   r\   r   )rŠ   Zfrom_dnZto_rdnZto_baser’   r¶   Zto_dnrÄ   r   r   r   Ú	do_rename¼  s    üzdbcheck.do_renamec                 C   sL   || j v r| j | S | j |¡}|r2| j |¡}nd }||f| j |< ||fS ©N)ro   r/   Zget_linkId_from_lDAPDisplayNameZ!get_backlink_from_lDAPDisplayName)rŠ   ÚattrnameÚlinkIDZrevnamer   r   r   Ú get_attr_linkID_and_reverse_nameÏ  s    

z(dbcheck.get_attr_linkID_and_reverse_namec                 C   s†   |   d||f ¡ |  d||f d¡s8|   d| ¡ dS t ¡ }||_t dtj|¡||< | j|ddgd	| d
dr‚|   d| ¡ dS )zfix empty attributeszERROR: Empty attribute %s in %sz"Remove empty attribute %s from %s?r5   zNot fixing empty attribute %sNr   r¡   rž   z#Failed to remove empty attribute %sFr¦   zRemoved empty attribute %s)r“   r¨   r]   r­   r   r®   ÚFLAG_MOD_DELETEr°   )rŠ   r   rË   rÈ   r   r   r   Úerr_empty_attributeÚ  s    ÿzdbcheck.err_empty_attributec           
      C   sL  |   d||f ¡ g }|D ]v}| j | j||g¡}t|ƒdkr\|   d| ¡ | |df¡ q|d |kr|   d||d f ¡ | ||d f¡ q|  d||f d¡s¸|   d	| ¡ d
S t ¡ }||_	t
dt|ƒƒD ]H}|| \}}	t |tj|¡|d| < |	dkrÔt |	tj|¡|d| < qÔ| j|ddgd| ddrH|   d| ¡ d
S )ú"fix attribute normalisation errorsz1ERROR: Normalisation error for attribute %s in %sr(   zUnable to normalise value '%s'r   r   zvalue '%s' should be '%s'z!Fix normalisation for %s from %s?r6   zNot fixing attribute %sNzvalue_%uznormv_%ur¡   rž   ú Failed to normalise attribute %sFr¦   úNormalised attribute %s)r“   r.   Údsdb_normalise_attributesr/   r   rƒ   r¨   r]   r­   r   Úranger®   rÎ   ÚFLAG_MOD_ADDr°   )
rŠ   r   rË   ÚvaluesZmod_listÚvalÚ
normalisedrÈ   ÚiZnvalr   r   r   Úerr_normalise_mismatchè  s:    
ÿ
ÿþzdbcheck.err_normalise_mismatchc                 C   s¾   | j  | j||¡}|  d||f ¡ |  d|t|ƒf ¡ t|ƒ|krJdS |  d||f d¡sp|  d| ¡ dS t ¡ }||_t 	|tj
|¡||< | j|ddgd	| d
drº|  d| ¡ dS )rÐ   z5ERROR: Normalisation error for attribute '%s' in '%s'z0Values/Order of values do/does not match: %s/%s!Nz%Fix normalisation for '%s' from '%s'?r6   úNot fixing attribute '%s'r¡   rž   rÑ   Fr¦   rÒ   )r.   rÓ   r/   r“   Úlistr¨   r]   r­   r   r®   r¯   r°   )rŠ   r   rË   rÖ   rØ   rÈ   r   r   r   Úerr_normalise_mismatch_replace  s     þz&dbcheck.err_normalise_mismatch_replacec                 C   s¬   |   d||f ¡ |   dd t|ƒ¡d t|ƒ¡f ¡ |  d||f d¡s^|   d| ¡ dS t ¡ }||_t |tj|¡||< | j	|dd	gd
| ddr¨|   d| ¡ dS )rÐ   z2ERROR: Duplicate values for attribute '%s' in '%s'z&Values contain a duplicate: [%s]/[%s]!r   z"Fix duplicates for '%s' from '%s'?r7   rÛ   Nr¡   rž   z0Failed to remove duplicate value on attribute %sFr¦   z'Removed duplicate value on attribute %s)
r“   Újoinr   r¨   r]   r­   r   r®   r¯   r°   )rŠ   r   rË   Z
dup_valuesrÖ   rÈ   r   r   r   Úerr_duplicate_values  s    &þzdbcheck.err_duplicate_valuesc                 C   s   |j dtj kS )z2see if a dsdb_Dn is the special Deleted Objects DNzB:32:%s:)Úprefixr   r‚   )rŠ   r³   r   r   r   r¬   ,  s    zdbcheck.is_deleted_objects_dnc                 C   sb   |   d|| j |¡f ¡ |  d| d¡s<|   d| ¡ dS |  |dgd| ¡r^|   d| ¡ dS )	z!handle object without objectclassz¡ERROR: missing objectclass in object %s.  If you have another working DC, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> %s'zIIf you cannot re-sync from another DC, do you wish to delete object '%s'?rh   z1Not deleting object with missing objectclass '%s'Nr¡   úFailed to remove DN %súRemoved DN %s)r“   r.   Úget_nc_rootr¨   rÅ   ©rŠ   r   r   r   r   Úerr_missing_objectclass0  s    
ÿzdbcheck.err_missing_objectclassc                 C   sÖ   |sF|   d|||f ¡ |   dt|ƒ ¡ |  dd¡s†|   d¡ dS n@|   d|||f ¡ |   dt|ƒ ¡ |  dd	¡s†|   d¡ dS t ¡ }||_t |tj|¡|d
< |  |ddt	j
 gd| ¡rÒ|   d| ¡ dS )z(handle a DN pointing to a deleted objectz4ERROR: target DN is deleted for %s in object %s - %sz#Target GUID points at deleted DN %rzRemove DN link?r:   zNot removingNz6WARNING: target DN is deleted for %s in object %s - %szRemove stale DN link?r;   Ú	old_valuerž   r¿   z(Failed to remove deleted DN attribute %sz"Removed deleted DN on attribute %s)r“   r   r¨   r]   r­   r   r®   rÎ   r°   r   Ú DSDB_CONTROL_REPLMD_VANISH_LINKS)rŠ   r   rË   r×   r³   Ú
correct_dnZremove_plausiblerÈ   r   r   r   Úerr_deleted_dn:  s(    

ÿþzdbcheck.err_deleted_dnc              
   C   s°  t |ƒ d¡dkr4|  d|||f ¡ |  d¡ dS |  |¡\}}|d@ dkr„t |ƒ d¡dkr„|  |¡\}}|durœ|  d|||f ¡ |  d	¡ dS | j |¡}z| j |j¡}	W n@ tjyú }
 z&|
j	\}}|tj
krâ‚ d}	W Y d}
~
n
d}
~
0 0 |	du r,|  d
||j||f ¡ |  d¡ dS ||	krX|  d|||f ¡ |  d¡ dS |  d|||f ¡ |  |||||d¡ dS |  d|||f ¡ |  |||||d¡ dS )zxhandle a missing target DN (if specified, GUID form can't be found,
        and otherwise DN string form can't be found)z\0ADELéÿÿÿÿzTWARNING: no target object found for GUID component link %s in deleted object %s - %sz`Not removing dangling one-way link on deleted object (tombstone garbage collection in progress?)r   r(   Nz`WARNING: no target object found for GUID component for one-way forward link %s in object %s - %sz"Not removing dangling forward linkzeWARNING: no target object found for GUID component for link %s in object to %s outside our NCs%s - %szhNot removing dangling one-way left-over link outside our NCs (we might be building a renamed/lab domain)z`WARNING: no target object found for GUID component for cross-partition link %s in object %s - %szPNot removing dangling one-way cross-partition link (we might be mid-replication)zTWARNING: no target object found for GUID component for DN value %s in object %s - %sTzNERROR: no target object found for GUID component for link %s in object %s - %sF)r   Úfindr“   rÍ   r.   rã   r   r]   rt   ru   rv   ré   )rŠ   r   rË   r×   r³   rÌ   Ú_Úreverse_link_nameÚnc_rootZtarget_nc_rootÚerŒ   r   r   r   r   Úerr_missing_target_dn_or_GUIDQ  s`    þ
"ÿý



ý

ý
þ
ÿþz%dbcheck.err_missing_target_dn_or_GUIDc              
   C   sp  |   d||||f ¡ ddg}z | jjt|jƒtjg |d}W nb tjy  } zH|j\}	}
|   d|j|
f ¡ |	tj	krz‚ |  
||||¡ W Y d}~dS d}~0 0 t|ƒdkrÒ|   d|j ¡ |  
||||¡ dS |d j|_|  d	t|ƒ d
¡s|   d| ¡ dS t ¡ }||_t |tj|¡|d< t t|ƒtj|¡|d< |  |dgd||f ¡rl|   d||f ¡ dS )z+handle a missing GUID extended DN componentz,ERROR: %s component for %s in object %s - %sr   rž   r‘   z&unable to find object for DN %s - (%s)Nr   zunable to find object for DN %súChange DN to %s?r8   úNot fixing %sræ   Ú	new_valueú Failed to fix %s on attribute %súFixed %s on attribute %s)r“   r.   rq   r   r   r]   rr   rt   ru   rv   rð   r   r¨   r­   r®   rÎ   rÕ   r°   )rŠ   r   rË   r×   r³   Úerrstrr’   r‹   Ze7rŒ   r   rÈ   r   r   r   Úerr_missing_dn_GUID_component¦  s:    ÿ




ÿz%dbcheck.err_missing_dn_GUID_componentc                 C   s¤   |   d||||f ¡ |  dt|ƒ d¡s<|   d| ¡ dS t ¡ }||_t |tj|¡|d< t t|ƒtj|¡|d< |  	|dgd	||f ¡r |   d
||f ¡ dS )z'handle an incorrect binary DN componentz3ERROR: %s binary component for %s in object %s - %srñ   r9   rò   Nræ   ró   rž   rô   rõ   )
r“   r¨   r   r]   r­   r   r®   rÎ   rÕ   r°   )rŠ   r   rË   r×   r³   rö   rÈ   r   r   r   Úerr_incorrect_binary_dnÆ  s    

ÿzdbcheck.err_incorrect_binary_dnc                 C   s¤   |   d|||f ¡ ||_|  dt|ƒ d¡s<|   d¡ dS t ¡ }||_t |tj|¡|d< t t|ƒtj|¡|d< |  	|dd	t
j gd
| ¡r |   d| ¡ dS )ú"handle a DN string being incorrectzPNOTE: old (due to rename or delete) DN string component for %s in object %s - %srñ   r=   zNot fixing old string componentNræ   ró   rž   úlocal_oid:%s:1z+Failed to fix old DN string on attribute %sz#Fixed old DN string on attribute %s)r“   r   r¨   r   r]   r­   r®   rÎ   rÕ   r°   r   Ú%DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME)rŠ   r   rË   r×   r³   rè   rÈ   r   r   r   Úerr_dn_string_component_oldÖ  s"    ÿ
ÿþz#dbcheck.err_dn_string_component_oldc                 C   s®   |   d||||f ¡ ||_|  dt|ƒ d| ¡sF|   d| ¡ dS t ¡ }||_t |tj|¡|d< t t|ƒtj|¡|d< |  	|dgd	||f ¡rª|   d
||f ¡ dS )rù   z9ERROR: incorrect DN %s component for %s in object %s - %srñ   z fix_all_%s_dn_component_mismatchz Not fixing %s component mismatchNræ   ró   rž   z-Failed to fix incorrect DN %s on attribute %sz%Fixed incorrect DN %s on attribute %s)
r“   r   r¨   r   r]   r­   r®   rÎ   rÕ   r°   )rŠ   r   rË   r×   r³   rè   Zmismatch_typerÈ   r   r   r   Ú err_dn_component_target_mismatchè  s    ÿ

ÿz(dbcheck.err_dn_component_target_mismatchc                 C   sú   |   d|||f ¡ t|jƒdkr0|   d¡ dS t | j|j ¡ ¡}| d|¡ |  	d| ¡  d¡sr|   d¡ dS | 
d	¡}t | jd
¡}| d	|¡ | d|¡ t ¡ }	||	_t | ¡ tj|¡|	d< ddtj g}
|  |	|
d| ¡rö|   d| ¡ dS )rù   z8ERROR: missing DN SID component for %s in object %s - %sr   z3Not fixing missing DN SID on DN+BINARY or DN+STRINGNÚSIDrñ   r<   z#Not fixing missing DN SID componentr    r   ró   rž   rú   z,Failed to ADD missing DN SID on attribute %sz$Fixed missing DN SID on attribute %s)r“   r   rà   r]   r^   r.   r   Úextended_strÚset_extended_componentr¨   r©   r­   r®   rÕ   r   Z$DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SIDr°   )rŠ   r   rË   r×   r³   Ztarget_sid_blobrè   Ztarget_guid_blobZguid_sid_dnrÈ   r’   r   r   r   Ú#err_dn_component_missing_target_sidù  s2    
ÿ

þÿz+dbcheck.err_dn_component_missing_target_sidc                 C   s‚   |   d||jf ¡ |  d| d¡s6|   d| ¡ dS t ¡ }|j|_t g tj|¡|d< |  |ddgd	| ¡r~|   d
| ¡ dS )z!handle an unknown attribute errorz#ERROR: unknown attribute '%s' in %szRemove unknown attribute %sr4   zNot removing %sNræ   r¡   rž   z%Failed to remove unknown attribute %szRemoved unknown attribute %s)r“   r   r¨   r]   r­   r®   rÎ   r°   )rŠ   ÚobjrË   rÈ   r   r   r   Úerr_unknown_attribute  s    ÿzdbcheck.err_unknown_attributec                 C   sŽ   |   d|||jf ¡ |  d| d¡s8|   d| ¡ dS t ¡ }|j|_t |tj|¡|d< |  |ddd	d
tj	 gd| ¡rŠ|   d| ¡ dS )z:handle a link that should not be there on a deleted objectzDERROR: linked attribute '%s' to '%s' is present on deleted object %szRemove linked attribute %sr@   z Not removing linked attribute %sNræ   rž   rœ   rŸ   r¿   z Failed to delete forward link %szFixed undead forward link %s)
r“   r   r¨   r]   r­   r®   rÎ   r°   r   rç   )rŠ   r  rË   r×   rÈ   r   r   r   Úerr_undead_linked_attribute&  s    
ÿÿþz#dbcheck.err_undead_linked_attributec                 C   s„   |   d||||jf ¡ |  d| d¡s:|   d| ¡ dS t ¡ }||_t |tj|¡|d< |  |ddgd	| ¡r€|   d
| ¡ dS )zhandle a missing backlink valuez>ERROR: missing backlink attribute '%s' in %s for link %s in %szFix missing backlink %srA   zNot fixing missing backlink %sNró   rž   r¡   z!Failed to fix missing backlink %szFixed missing backlink %s)r“   r   r¨   r]   r­   r®   rÕ   r°   )rŠ   r  rË   r×   Zbacklink_nameÚ	target_dnrÈ   r   r   r   Úerr_missing_backlink6  s    ÿzdbcheck.err_missing_backlinkc                 C   s    t |j d¡ƒ}|  d|||j|j ¡ f ¡ |  d| d¡sP|  d| ¡ dS t ¡ }|j|_t t	|ƒtj
|¡|d< |  |g d¢d	| ¡rœ|  d
| ¡ dS )z"handle a incorrect RMD_FLAGS valueÚ	RMD_FLAGSzHERROR: incorrect RMD_FLAGS value %u for attribute '%s' in %s for link %szFix incorrect RMD_FLAGS %urG   z!Not fixing incorrect RMD_FLAGS %uNræ   )rž   rŸ   úshow_deleted:0z$Failed to fix incorrect RMD_FLAGS %uzFixed incorrect RMD_FLAGS %u)r‰   r   r©   r“   rÿ   r¨   r]   r­   r®   r   rÎ   r°   )rŠ   r  rË   Zrevealed_dnÚ	rmd_flagsrÈ   r   r   r   Úerr_incorrect_rmd_flagsC  s    ÿzdbcheck.err_incorrect_rmd_flagsc           	      C   s¶   |du r4|   |||¡r4|  dd||||f  ¡ dS |  d||||f ¡ |  d| d¡sl|  d| ¡ dS t ¡ }||_t |tj|¡|d	< |  |d
dgd| ¡r²|  d| ¡ dS )z handle a orphaned backlink valueTz*WARNING: Keep orphaned backlink attribute z"'%s' in '%s' for link '%s' in '%s'Nz?ERROR: orphaned backlink attribute '%s' in %s for link %s in %szRemove orphaned backlink %srB   z!Not removing orphaned backlink %sr   rž   r¡   z"Failed to fix orphaned backlink %szFixed orphaned backlink %s)	Úhas_duplicate_linksr“   r¨   r]   r­   r   r®   rÎ   r°   )	rŠ   Zobj_dnÚbacklink_attrZbacklink_valr  Úforward_attrÚforward_syntaxÚcheck_duplicatesrÈ   r   r   r   Úerr_orphaned_backlinkQ  s$    ÿÿÿzdbcheck.err_orphaned_backlinkc                 C   s¶   |   d||jf ¡ |  d| d¡s<|   d||jf ¡ dS t ¡ }|j|_t |tj|¡|d< |  |dtj	 gd| ¡r²|   d	| ¡ d
t
|jƒ|f }|| jv s¨J ‚d| j|< dS )zhandle a duplicate links valuezPRECHECK: 'Missing/Duplicate/Correct link' lines above for attribute '%s' in '%s'zDCommit fixes for (missing/duplicate) forward links in attribute '%s'rF   zPNot fixing corrupted (missing/duplicate) forward links in attribute '%s' of '%s'Nr   rú   z/Failed to fix duplicate links in attribute '%s'z'Fixed duplicate links in attribute '%s'r£   F)r“   r   r¨   r]   r­   r®   r¯   r°   r   Z(DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKSr   rE   )rŠ   r  r  Zforward_valsrÈ   Úduplicate_cache_keyr   r   r   Úerr_recover_forward_linkse  s     ÿÿz!dbcheck.err_recover_forward_linksc                 C   sÌ   |   d|j ¡ | jjdtjdgd}t|ƒdks6J ‚t|d d d ƒ}|  d|j|f d¡sx|   d	|j|f ¡ d
S t 	¡ }|j|_t 
|tjd¡|d< |  |g d|j|f ¡rÈ|   d|j|f ¡ d
S )zhandle a missing fSMORoleOwnerz*ERROR: fSMORoleOwner not found for role %sr   ÚdsServiceName)r"   r#   r(   r   z8Seize role %s onto current DC by adding fSMORoleOwner=%srJ   z>Not Seizing role %s onto current DC by adding fSMORoleOwner=%sNÚfSMORoleOwnerr   zBFailed to seize role %s onto current DC by adding fSMORoleOwner=%sz9Seized role %s onto current DC by adding fSMORoleOwner=%s)r“   r   r.   rq   r]   rr   r   r   r¨   r­   r®   rÕ   r°   )rŠ   r  r‹   ZserviceNamerÈ   r   r   r   Úerr_no_fsmoRoleOwnerx  s     ÿÿzdbcheck.err_no_fsmoRoleOwnerc              
   C   sb  |   d|j ¡ |  d|j d¡s6|   d|j ¡ dS d}| j ¡  zä| j |j¡}| j |tj¡}t	 
| jt|jƒ¡}| t|ƒd ¡ |  |j||dd	gd
|j|| f ¡r&|   d|j|| f ¡ t	 ¡ }|j|_t	 t|j ¡ ƒt	jd¡|d< |  |g d||  ¡r&|   d||  ¡ d}W n   | j ¡  ‚ Y n0 |rT| j ¡  n
| j ¡  dS )zhandle a missing parentz%ERROR: parent object not found for %sz!Move object %s into LostAndFound?rK   z&Not moving object %s into LostAndFoundNFr(   r  r¡   z2Failed to rename object %s into lostAndFound at %sz)Renamed object %s into lostAndFound at %sZlastKnownParentz:Failed to set lastKnownParent on lostAndFound object at %sz0Set lastKnownParent on lostAndFound object at %sT)r“   r   r¨   r.   Útransaction_startrã   r€   r   ZDS_GUID_LOSTANDFOUND_CONTAINERr]   r^   r   Úremove_base_componentsr   rÉ   r­   r®   Úparentr¯   r°   Útransaction_cancelÚtransaction_commit)rŠ   r  Zkeep_transactionrî   Zlost_and_foundÚnew_dnrÈ   r   r   r   Úerr_missing_parent‰  s:    
ÿ
ÿ
zdbcheck.err_missing_parentc           
   	   C   sÎ   t  | jt|ƒ¡}| t|ƒd ¡ | ¡ }d}	||krH|	d||f 7 }	|	d| 7 }	|  d|j|	|f ¡ |  	d|j|f d¡s˜|  d|j|f ¡ d	S |  
|j|||d
|j|f ¡rÊ|  d|j|f ¡ d	S )zhandle a wrong dnr(   r   z%s=%r zname=%rz!ERROR: wrong dn[%s] %s new_dn[%s]zRename %s to %s?rR   zNot renaming %s to %sNz"Failed to rename object %s into %szRenamed %s into %s)r]   r^   r.   r   r  r   r  r“   r   r¨   rÉ   )
rŠ   r  r  Úrdn_attrZrdn_valÚname_valr’   Znew_rdnZ
new_parentZ
attributesr   r   r   Úerr_wrong_dn¬  s    ÿzdbcheck.err_wrong_dnc                 C   s´   |   d|d |j|f ¡ |  d|d ||jf d¡sT|   d|d ||jf ¡ dS t ¡ }|j|_t t|ƒtjd¡|d< |  |dt	j
 gd	|j|f ¡r°|   d
|j|f ¡ dS )zhandle a wrong instanceTypez0ERROR: wrong instanceType %s on %s, should be %dÚinstanceTypez(Change instanceType from %s to %d on %s?rL   z-Not changing instanceType from %s to %d on %sNr   r¿   zGFailed to correct missing instanceType on %s by setting instanceType=%dz7Corrected instancetype on %s by setting instanceType=%d)r“   r   r¨   r]   r­   r®   r   r¯   r°   r   Ú&DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)rŠ   r  Úcalculated_instancetyperÈ   r   r   r   Úerr_wrong_instancetypeÁ  s    ÿzdbcheck.err_wrong_instancetypec                 C   s"   |   d|j| j |j¡f ¡ d S )NzÌERROR: incorrect userParameters value on object %s.  If you have another working DC that does not give this warning, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> %s'©r“   r   r.   rã   )rŠ   r  rË   r   r   r   r   Úerr_short_userParametersÏ  s    z dbcheck.err_short_userParametersc                 C   s’   |   d||jf ¡ |  d|j d¡s:|   d|j ¡ dS t ¡ }|j|_t t|| d ƒtjd¡|d< |  |g d	|j ¡rŽ|   d
|j ¡ dS )úhandle a wrong userParameterszNERROR: wrongly formatted userParameters %s on %s, should not be base64-encodedz2Convert userParameters from base64 encoding on %s?rS   z6Not changing userParameters from base64 encoding on %sNr   ÚuserParametersr   zOFailed to correct base64-encoded userParameters on %s by converting from base64zGCorrected base64-encoded userParameters on %s by converting from base64)	r“   r   r¨   r]   r­   r®   r   r¯   r°   ©rŠ   r  rË   r   rÈ   r   r   r   Úerr_base64_userParametersÓ  s     ÿz!dbcheck.err_base64_userParametersc                 C   s–   |   d|j ¡ |  d|j d¡s6|   d|j ¡ dS t ¡ }|j|_t || d  d¡ d¡tjd	¡|d
< |  	|g d|j ¡r’|   d|j ¡ dS )r&  zOERROR: wrongly formatted userParameters on %s, should not be psudo-UTF8 encodedz0Convert userParameters from UTF8 encoding on %s?rT   z4Not changing userParameters from UTF8 encoding on %sNr   r$   ú	utf-16-ler'  r   zQFailed to correct psudo-UTF8 encoded userParameters on %s by converting from UTF8zICorrected psudo-UTF8 encoded userParameters on %s by converting from UTF8©
r“   r   r¨   r]   r­   r®   r   Úencoder¯   r°   r(  r   r   r   Úerr_utf8_userParametersá  s    ÿÿzdbcheck.err_utf8_userParametersc                 C   s–   |   d|j ¡ |  d|j d¡s6|   d|j ¡ dS t ¡ }|j|_t || d  d¡ d¡tjd	¡|d
< |  	|g d|j ¡r’|   d|j ¡ dS )r&  zQERROR: wrongly formatted userParameters on %s, should not be double UTF16 encodedz:Convert userParameters from doubled UTF-16 encoding on %s?rU   z>Not changing userParameters from doubled UTF-16 encoding on %sNr   r*  r$   r'  r   zJFailed to correct doubled-UTF16 encoded userParameters on %s by convertingzBCorrected doubled-UTF16 encoded userParameters on %s by convertingr+  r(  r   r   r   Úerr_doubled_userParametersð  s    ÿÿz"dbcheck.err_doubled_userParametersc                 C   s"   |   d|j| j |j¡f ¡ d S )NzÙERROR: incorrect userParameters value on object %s (odd length).  If you have another working DC that does not give this warning, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> %s'r$  )rŠ   r  rË   r   r   r   Úerr_odd_userParameters
  s    zdbcheck.err_odd_userParametersc           	      C   sn   | j j|tj|gg d¢d}| j |¡}|d | D ]4}t| j | d¡|ƒ}|j 	d¡}||kr4|  S q4dS )z#return a revealed link in an object)r  r¢   rŸ   r‘   r   r$   r    N)
r.   rq   r]   rr   r/   Ú#get_syntax_oid_from_lDAPDisplayNamer   r   r   r©   )	rŠ   r   rË   r±   r‹   Ú
syntax_oidr×   r³   Zguid2r   r   r   Úfind_revealed_link  s    ÿ
zdbcheck.find_revealed_linkc                 C   s  d}t ƒ }t ƒ }|d@ r"|||fS |du r4|||fS dt|jƒ|f }	|	| jvrZd| j|	< || D ]}
t| j|
 d¡|ƒ}|j d¡}|du r’qbtt 	|¡ƒ}||j
 }||vr¼|||< qb|d7 }||vrðt ƒ ||< d|| d< tƒ || d	< t|| j d
¡ƒ}t|j d
¡ƒ}||krB|| || d< || d	  |¡ qb||k rx||| d< || d	  || ¡ |||< qbt|| j d¡ƒ}t|j d¡ƒ}||krÊ|| || d< || d	  |¡ qb||| d< || d	  || ¡ |||< qb|dkr
d| j|	< |||fS )ú1check a linked values for duplicate forward linksr   r(   Nr£   Fr$   r    ÚkeeprÂ   ÚRMD_VERSIONÚRMD_LOCAL_USNT)rD   r   r   rE   r   r.   r   r©   r   r    rà   rÜ   r‰   rƒ   )rŠ   r  r  r  Úforward_linkIDr  r™   Úduplicate_dictÚunique_dictr  r×   r³   r±   ÚguidstrÚkeystrZv1Zv2Zu1Zu2r   r   r   Úcheck_duplicate_links  s`    











zdbcheck.check_duplicate_linksc              
   C   sÚ   d}dt |ƒ|f }|| jv r(| j| S |  |¡\}}|g}ddg}	z| jjt |ƒtj||	d}
W n> tjy  } z$|j\}}|tj	krŠ‚ W Y d}~dS d}~0 0 |
d }|  
|||||¡\}}}|| jv rÖ| j| S dS )r3  r   r£   r   rŸ   r‘   NF)r   rE   rÍ   r.   rq   r]   rr   rt   ru   rv   r<  )rŠ   r   r  r  r™   r  r7  r  r#   r’   r‹   Ze8rŒ   r   r  r8  r9  r   r   r   r  [  s,    

ÿ


ÿ

zdbcheck.has_duplicate_linksc               
   C   s  g }d}|du r||fS |t jkr8|  d| ¡ ||fS d| jv rT|  d¡ ||fS zH|d d }tttj|ƒƒ}	d||	f }
| jj	|
t j
dgg d¢d	}W n2 t jyÎ } z|j\}}‚ W Y d}~n
d}~0 0 |D ]<}t| j|j ¡ |ƒ}|j d
¡}tt |¡ƒ}||v rqÔttj|d d ƒ}|jjD ]&}|j}|j}|jtjkr0 qXq0t d¡}d}|}|}d}|}|}|}d}|j dt|ƒ¡ |j dt|ƒ¡ |j dt|ƒ¡ |j dt|ƒ¡ |j dt|ƒ¡ |j dt|ƒ¡ |j dt|ƒ¡ |d7 }| |¡ qÔ||fS )zMFind all backlinks linking to obj_guid_str not already in forward_unique_dictr   Nz5Not checking for missing forward links for syntax: %sZsortedLinkszQNot checking for missing forward links because the db has the sortedLinks featureÚ
objectGUIDz(%s=<GUID=%s>))r   úsearch_options:1:2zpaged_results:1:1000)r'   r"   r#   r’   r    ÚreplPropertyMetadataz$ffffffff-4700-4700-4700-000000b13228r(   ZRMD_ADDTIMEZRMD_CHANGETIMEr  ZRMD_INVOCIDZRMD_ORIGINATING_USNr6  r5  )r]   Ú	SYNTAX_DNr“   r,   r   r   r   r    r.   rq   ÚSCOPE_SUBTREErt   ru   r   r   rÿ   r©   r
   ÚreplPropertyMetaDataBlobÚctrÚarrayÚ	local_usnÚoriginating_change_timeÚattidr   ZDRSUAPI_ATTID_objectClassr   r	   rƒ   ) rŠ   r  r  r  r  Zforward_unique_dictÚmissing_forward_linksr™   Úobj_guidZobj_guid_strÚfilterr‹   Ze9rŒ   r   Úrr  r±   r:  Úreplr²   rE  ÚtZoriginating_invocidÚoriginating_usnZrmd_addtimeZrmd_changetimer	  Zrmd_invocidZrmd_originating_usnZrmd_local_usnZrmd_versionr   r   r   Ú)find_missing_forward_links_from_backlinks|  sp    
ÿ

þ




ÿ


z1dbcheck.find_missing_forward_links_from_backlinksc           5      C   s 	  d}|d d }|   |¡\}}|dur4| j |¡}nd}|dv }	|	rP| jrPi }
n|  |||||¡\}}
}t|
ƒdkrª|  |||||¡\}}||7 }dd„ | ¡ D ƒ}|dkrÄ|  d||j	f ¡ n|  d||j	f ¡ |D ]R}|  d	| ¡ |  
d
| d¡s$| j|j	||j	 ¡ |j	||dd qÜ||g7 }qÜ|
 ¡ D ]>}|
| }|d D ]}|  d| ¡ qL|  d|d  ¡ q8dd„ t|ƒD ƒ}|  |||¡ t |d|¡||< || D ]f}t| j| d¡|ƒ}|j	 d¡}|du r|d7 }|  |j	|||d¡ q²tt |¡ƒ}ddg}t|ƒ ¡ dkrH|j	| jkrHd}| d¡ nd}|dur`| |¡ z"| jjd| tj|g d¢d}W nd tjyæ } zH|j \}}|tj!kr®‚ ||  "|j	|||¡7 }W Y d}~q²W Y d}~n
d}~0 0 |rTdt#|d d d ƒ |_$d t#|d d d ƒ |_%t|ƒt|ƒkrT|d7 }|  &|j	|||d!¡ q²d|v ott|d d ƒ '¡ d"k}d|d v ožt|d d d ƒ '¡ d"k}|rÖ|j	| j(vrÖ|rÖ|  )|||¡ |d7 }q²nÞ|r´|  *|¡s´|r´|d7 }|j	 d#¡} | r”d|d v r”t+t,j-|d d$ d ƒ}!d}"|!j.j/D ]2}#|#j0t1j2kr:|#j3}$|$t#| ƒkr:d}" qnq:|"r”|  4|j	||||d j	d¡ q²|  4|j	||||d j	d¡ q²|j	 d%¡}%d}&|%durÖt#|%ƒ}&|&d@ s,|dur,t|d j	ƒt|j	ƒkr,|d7 }|  5|j	||||d j	d&¡ q²|d j	 d¡|j	 d¡krr|d7 }|  5|j	||||d j	d¡ q²|d j	 d'¡}'|j	 d'¡}(|(du rÂ|'durÂ|d7 }|  6|j	||||'¡ q²|(|'krô|d7 }|  5|j	||||d j	d'¡ q²|du rP|dkr²t|d j	ƒt|j	ƒkr²|j$|j	 7¡  })|  8|j	||)||d j	¡ q²|	rb| jrbq²d}*||d v rè|d | D ]f}+t| j|+ d¡ƒ},|,j	 d¡}-|,j	 d%¡}.d}/|.durÄt#|.ƒ}/|/d@ rÒq€|-|kr€|*d7 }*q€|*dkrb|t9j:ks
|t9j:krb|d@ sbd}0|| D ]2}1t| j|1 d¡ƒj	 d¡}2|2|kr |0d7 }0q |*|0krbq²d}3|| D ]f}+t| j|+ d¡ƒ},|,j	 d¡}-|,j	 d%¡}.d}/|.dur²t#|.ƒ}/|/d@ rÀqn|-|krn|3d7 }3qn|*|3kräq²|3|* }4|d@ rN|*dkr$|d7 }|  |j	|||j	||¡ q²|  d(||3t|j	ƒ||*t|j	ƒf ¡ q²|rXJ ‚|  d)||3t|j	ƒ||*t|j	ƒf ¡ |4dkr²|d7 }|4dkrê|*dks®|4dkrÆ|  d*t|j	ƒ ¡ q²|  ;|||j	 ¡ ||j	¡ |4d8 }4n*|  |d j	||j	 ¡ |j	||¡ |4d7 }4q~q²|S )+z$check a DN attribute for correctnessr   r=  N)ÚmemberZmemberOfc                 S   s   g | ]}|‘qS r   r   ©Ú.0r   r   r   r   Ú
<listcomp>þ  ó    z$dbcheck.check_dn.<locals>.<listcomp>zKERROR: Missing and duplicate forward link values for attribute '%s' in '%s'z?ERROR: Duplicate forward link values for attribute '%s' in '%s'zMissing   link '%s'z7Schedule readding missing forward link for attribute %srC   F)r  rÂ   zDuplicate link '%s'zCorrect   link '%s'r4  c                 S   s   g | ]}t |ƒ‘qS r   ©r   rQ  r   r   r   rS    rT  r$   r    r(   zmissing GUIDÚ	isDeletedÚreplPropertyMetaDatazmsds-hasinstantiatedncsTr   ú	<GUID=%s>)r   rž   rŸ   r‘   z	B:8:%08X:z%08Xz(incorrect instanceType part of Binary DNÚTRUEr6  r?  r  Ústringrþ   zHWARNING: Link (back) mismatch for '%s' (%d) on '%s' to '%s' (%d) on '%s'zIERROR: Link (forward) mismatch for '%s' (%d) on '%s' to '%s' (%d) on '%s'z5ERROR: Can't fix missing multi-valued backlinks on %s)<rÍ   r/   r0  rW   r<  r   rO  rÖ   r“   r   r¨   r  rÿ   ÚkeysÚsortedr  r]   r®   r   r.   r   r©   r÷   r   r   r    Úlowerre   rƒ   rq   rr   rt   ru   rv   rð   r‰   rà   Zbinaryrø   Úupperr{   r  r¬   r   r
   rB  rC  rD  rG  r   ÚDRSUAPI_ATTID_isDeletedrE  ré   rý   r  rˆ   rü   r   r«   r  )5rŠ   r  rË   r1  r™   rI  rÌ   rí   Zreverse_syntax_oidZis_member_linkr8  r9  rH  Zmissing_error_countZforward_linksrÈ   r;  ÚdZddr   r×   r³   r±   r:  r#   Zfixing_msDS_HasInstantiatedNCsr‹   Ze3rŒ   r   Ú
is_deletedZtarget_is_deletedrE  rL  Z
found_datar²   Zdeleted_usnZrmd_blobr	  Z
target_sidZlink_sidZbad_dnZmatch_countÚvZv_dnZv_guidZv_blobZv_rmd_flagsZforward_countÚwZw_guidZexpected_countZ
diff_countr   r   r   Úcheck_dnâ  sÌ   

ÿÿýÿÿ

ÿ
ý
ÿ 

ÿ


ý$"*ÿ

ÿ

ÿ
ÿÿ

ÿ	
$
ÿ













ýþ
þ

ÿý
þzdbcheck.check_dnc                 C   s$   |j jD ]}|j|kr|  S qd S rÊ   )rC  rD  rG  )rŠ   rL  rG  r²   r   r   r   Úfind_repl_attid  s    

zdbcheck.find_repl_attidc                 C   s*   t tj|ƒ}|  ||¡}|dur&|jS dS )z¡Read metadata properties and return the originating time for
           a given attributeId.

           :return: the originating time or 0 if not found
        Nr   )r   r
   rB  re  rF  )rŠ   r×   rG  rL  r²   r   r   r   Úget_originating_time  s
    zdbcheck.get_originating_timec                 C   sŽ   t ƒ }t ƒ }g }| | j¡}ttj|ƒ}|jjD ]R}| j 	|j
¡}	| |	 ¡ ¡ | |j
¡ | jj|	|d}
|
|j
kr0| |j
¡ q0|||fS )zgRead metadata properties and list attributes in it.
           raises KeyError if the attid is unknown.©Zis_schema_nc)rm   Úis_child_ofrb   r   r
   rB  rC  rD  r/   Úget_lDAPDisplayName_by_attidrG  r–   r]  rƒ   Úget_attid_from_lDAPDisplayName)rŠ   r   r×   Úset_attÚwrong_attidsZ
list_attidÚin_schema_ncrL  r²   ÚattÚcorrect_attidr   r   r   Úprocess_metadata   s    ÿ
zdbcheck.process_metadatac                 C   sœ   t ttj|d d ƒƒ}t | jd| ¡}| jj|tj|gddgd}|d }t 	¡ }||_
t || tj|¡||< |  |g d¢d| ¡r˜|  d	| ¡ d
S )zre-write replPropertyMetaData elements for a single attribute for a
        object. This is used to fix missing replPropertyMetaData elementsr=  r   rX  r>  rž   r‘   )r¡   r¤   rž   ú'Failed to fix metadata for attribute %szFixed metadata for attribute %sN)r   r   r   r    r]   r^   r.   rq   rr   r­   r   r®   r¯   r°   r“   )rŠ   r  ÚattrÚguid_strr   r‹   r¶   Únmsgr   r   r   Úfix_metadata6  s    ÿÿÿzdbcheck.fix_metadatac                 C   s€   |j tj@ rd S d}|jtjkr&d}n4|jtjkr8d}n"|jtjkrJd}n|jtjkrZd}|sbd S |jj tj	@ std S t
|jjƒS )NFT)Úflagsr   ZSEC_ACE_FLAG_INHERIT_ONLYÚtypeZ"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTZ!SEC_ACE_TYPE_ACCESS_DENIED_OBJECTZ SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECTZ SEC_ACE_TYPE_SYSTEM_ALARM_OBJECTrš   Z%SEC_ACE_INHERITED_OBJECT_TYPE_PRESENTr   Zinherited_type)rŠ   ÚaceZcheckr   r   r   Ú ace_get_effective_inherited_typeF  s     z(dbcheck.ace_get_effective_inherited_typec                 C   s\   || j v r| j | S d| }| jj| j|dgd}tttj|d d d ƒƒ}|| j |< |S )Nz0(&(ldapDisplayName=%s)(objectClass=classSchema))ZschemaIDGUID)r!   r'   r#   r   )rf   r.   rq   rb   r   r   r   r    )rŠ   ÚclsZfltr‹   rM  r   r   r   Úlookup_class_schemaIDGUID\  s    


þ
z!dbcheck.lookup_class_schemaIDGUIDc              
   C   sd  d}|| }t tj|d ƒ}d|v o:t|d d ƒ ¡ dk}|rH|d fS t ¡ }|j|_|j|_|j|_|j|_d}d }	g }
|j	d urŽ|j	j
}
tdt|
ƒƒD ]R}|
| }|jtj@ sÀ| |¡ qœ|  |¡}|d u rÔqœ|	d urê||	krœd}qœ|}	qœg }
|jd ur|jj
}
tdt|
ƒƒD ]b}|
| }|jtj@ s>| |¡ q|  |¡}|d u rVq|	d urr||	krd}q|}	q|rˆ||fS |	d u rš|d fS d }z|d d }W n& tyÔ } zW Y d }~n
d }~0 0 |d u r@| jj|tjddgd	gd
}|d }d|v o$t|d d ƒ ¡ dk}|r4|d fS |d d }|  |¡}||	kr\||fS |d fS )NÚnTSecurityDescriptorr   rV  rY  FTÚobjectClassrê   rž   r‘   )r   r   Ú
descriptorr   r^  Ú	owner_sidÚ	group_sidrw  ZrevisionZsaclÚacesrÔ   r   rv  ZSEC_ACE_FLAG_INHERITED_ACEZsacl_addry  ZdaclZdacl_addr~   r.   rq   r]   rr   r{  )rŠ   r   r  Úsd_attrÚsd_valÚsdra  Zsd_cleanZbrokenZlast_inherited_typer  rÙ   rx  rM  rz  rï   r‹   r²   r   r   r   Ú
process_sdi  sˆ     









þ"

zdbcheck.process_sdc                 C   s’   d}t |ƒ}tjtjB }|  d||f d¡sB|  d||f ¡ dS t ¡ }||_t 	|tj
|¡||< |  |d| gd| ¡rŽ|  d||f ¡ dS )	z/re-write the SD due to incorrect inherited ACEsr|  zFix %s on %s?rH   úNot fixing %s on %s
Núsd_flags:1:%dúFailed to fix attribute %súFixed attribute '%s' of '%s'
)r	   r   ÚSECINFO_DACLÚSECINFO_SACLr¨   r“   r]   r­   r   r®   r¯   r°   )rŠ   r   r„  Ú	sd_brokenr‚  rƒ  Úsd_flagsrt  r   r   r   Úerr_wrong_sdÒ  s    ÿzdbcheck.err_wrong_sdc           	      C   s¼   d}t |ƒ}tjtjB }|jdur,|tjO }|jdur@|tjO }|  d|||f d¡sl|  	d||f ¡ dS t
 ¡ }||_t
 |t
j|¡||< |  |d| gd| ¡r¸|  	d||f ¡ dS )	zare-write the SD due to not matching the default (optional mode for fixing an incorrect provision)r|  Nz,Reset %s on %s back to provision default?
%sr[   zNot resetting %s on %s
r‡  zFailed to reset attribute %sr‰  )r	   r   rŠ  r‹  r  ÚSECINFO_OWNERr€  ÚSECINFO_GROUPr¨   r“   r]   r­   r   r®   r¯   r°   )	rŠ   r   r„  Zsd_oldÚdiffr‚  rƒ  r  rÈ   r   r   r   Úerr_wrong_default_sdã  s"    



ÿzdbcheck.err_wrong_default_sdc                 C   s®   d}t |ƒ}tjtjB }|  d||f d¡sB|  d||f ¡ dS t ¡ }||_t 	|tj
|¡||< | j | j¡ |  |d| gd| ¡rœ|  d||f ¡ | j | j¡ dS )	z/re-write the SD due to a missing owner or groupr|  z'Fix missing owner or group in %s on %s?rI   z+Not fixing missing owner or group %s on %s
Nr‡  rq  r‰  )r	   r   r  r  r¨   r“   r]   r­   r   r®   r¯   r.   Zset_session_infory   r°   rw   )rŠ   r   r„  r‚  rƒ  r  rt  r   r   r   Úerr_missing_sd_ownerø  s    ÿzdbcheck.err_missing_sd_ownerc                 C   s  | j r
dS || jv rdS ttj|ƒ}|  |tj¡}t 	|j
¡}t ¡ }| jd }|| }||krddS || }	|d }
|
dkr¨|  d| ¡ |  dt |	¡|d f ¡ n&|  d| ¡ |  dt |	¡|
f ¡ |  d	|j|j|j|j|jt t 	|j
¡¡f ¡ |  jd
7  _dS )NFé€Q é   z`SKIPPING additional checks on object %s which very recently became an expired tombstone (normal)zbINFO: it is expected this will be expunged by the next daily task some time after %s, %d hours agoi  z+SKIPPING: object %s is an expired tombstonezTINFO: it was expected this object would have been expunged soon after%s, %d days agozHisDeleted: attid=0x%08x version=%d invocation=%s usn=%s (local=%s) at %sr(   T)rY   r{   r   r
   rB  re  r   r_  ÚsambaÚnttime2unixrF  Útimer*   r“   ÚctimerG  ÚversionÚoriginating_invocation_idrN  rE  rZ   )rŠ   r   Úrepl_valrL  rV  Údelete_timeZcurrent_timeÚtombstone_deltar´   Zexpunge_timeZ
delta_daysr   r   r   Úis_expired_tombstone  sF    

þýýúzdbcheck.is_expired_tombstonec           
      C   sœ   t tj|ƒ}|  |tj¡}t |j¡}| j	d }g }|j
jD ]V}|jtjkrNq<|j|jkr\q<|j|jkrjq<t |j¡}|| }	|	|krˆq<| |¡ q<||fS )Nr”  )r   r
   rB  re  r   r_  r–  r—  rF  r*   rC  rD  rG  rE  rƒ   )
rŠ   rœ  rL  rV  r  rž  Úfoundr²   Zchange_timer´   r   r   r   Úfind_changes_after_deletionM  s$    
z#dbcheck.find_changes_after_deletionc                    sV   ˆ   |¡\}}t|ƒdkrdS ‡ fdd„}ˆ  d| ¡ ||ƒ |D ]}||ƒ qDdS )Nr   Fc                    sh   zˆ j  | j¡}W n ty.   d| j }Y n0 ˆ  d|| j| j| j| j| jt	 
t | j¡¡f ¡ d S )Nú<unknown:0x%x08x>zA%s: attid=0x%08x version=%d invocation=%s usn=%s (local=%s) at %s)r/   ri  rG  r~   r“   rš  r›  rN  rE  r˜  r™  r–  r—  rF  )r²   Úattname©rŠ   r   r   Úreport_attidt  s    
ûz8dbcheck.has_changes_after_deletion.<locals>.report_attidz,ERROR: object %s, has changes after deletionT)r¡  r   r“   )rŠ   r   rœ  r   rV  r¥  r²   r   r¤  r   Úhas_changes_after_deletiono  s    
z"dbcheck.has_changes_after_deletionc              	   C   s  |   |¡\}}| | j¡}| ¡ }| jj||d}g }|D ]f}	|	j|krJq:|	jtjkrXq:|	jtj	krfq:z| j 
|	j¡}
W n ty”   d|	j }
Y n0 | |
¡ q:t|ƒdkrÐ|  dd |¡ ¡ |  d¡ d S |  d|| jf d¡sô|  d¡ d S |  |d	gd
| ¡r|  d| ¡ d S )Nrg  r¢  r   zUnexpeted attributes: %sr   z%Not fixing changes after deletion bugz6Delete broken tombstone object %s deleted %s days ago?rl   r¡   rá   râ   )r¡  rh  rb   Úget_rdn_namer/   rj  rG  r   ZDRSUAPI_ATTID_nameZDRSUAPI_ATTID_lastKnownParentri  r~   rƒ   r   r“   rÞ   r¨   r*   rÅ   )rŠ   r   rœ  r   rV  rm  r  Z	rdn_attidZ
unexpectedr²   r£  r   r   r   Úerr_changes_after_deletionˆ  sD    ÿ

ÿÿ

ÿz"dbcheck.err_changes_after_deletionc                 C   sl   t tj|ƒ}|j}d}|jD ]J}|jt d¡kr2qd}|  d||j	|j
t t |j¡¡| j ¡ f ¡ q|S )NFú$00000000-0000-0000-0000-000000000000Ta  ERROR: on replPropertyMetaData of %s, the instanceType on attribute 0x%08x,
                           version %d changed at %s is 00000000-0000-0000-0000-000000000000,
                           but should be non-zero.  Proposed fix is to set to our invocationID (%s).)r   r
   rB  rC  rD  r›  r   r    r“   rG  rš  r˜  r™  r–  r—  rF  r.   Úget_invocation_id)rŠ   r   Úrepl_meta_datarL  rC  r   r²   r   r   r   Ú"has_replmetadata_zero_invocationid¬  s     ÿ

þýz*dbcheck.has_replmetadata_zero_invocationidc                 C   s,  t tj|ƒ}|j}t tt ¡ ƒ¡}d}|jD ]X}|j	t
 d¡krDq.d}| j tj¡}	|jd |_||_t
 | j ¡ ¡|_	|	|_|	|_q.|r(t|ƒ}
t ¡ }||_|  d||| j ¡ f d¡sÖ|  d||f ¡ d S t ¡ }||_t |
tj|¡||< |  |dtj d	gd
| ¡r(|  d||f ¡ d S )NFr©  Tr(   zZFix %s on %s by setting originating_invocation_id on some elements to our invocationID %s?rM   z6Not fixing zero originating_invocation_id in %s on %s
r¿   ú#local_oid:1.3.6.1.4.1.7165.4.3.14:0rˆ  r‰  )r   r
   rB  rC  r–  Zunix2nttimer‰   r˜  rD  r›  r   r    r.   Zsequence_numberr]   ZSEQ_NEXTrš  rF  rª  rN  rE  r	   r­   r   r¨   r“   r®   r¯   r°   r   r!  )rŠ   r   rr  r«  rL  rC  Znowr   r²   ÚseqÚreplBlobr¶   rt  r   r   r   Ú"err_replmetadata_zero_invocationidÀ  sH    ÿ
ÿÿÿþz*dbcheck.err_replmetadata_zero_invocationidc              
   C   sb   t tj|ƒ}|j}|jD ]D}z| j |j¡}W q tyZ   |  	d|j||f ¡ Y  d S 0 qd S )NzIERROR: attributeID 0X%0X is not known in our schema, not fixing %s on %s
)
r   r
   rB  rC  rD  r/   ri  rG  r~   r“   )rŠ   r   rr  r«  rL  rC  r²   rn  r   r   r   Úerr_replmetadata_unknown_attidå  s    ÿ
z&dbcheck.err_replmetadata_unknown_attidc              
      sæ  t tj|ƒ}d}tƒ }tƒ ‰ i }| | j¡}	|j}
t|
jd d … dd„ d|
_t	|
jƒD ]ú}t
d||jf ƒ | j |j¡}| ¡ |v r<|  d|||f ¡ |  d|||j||| jf d¡sÞ|  d	|j|||f ¡  d S d
}ˆ  |j¡ |j|| jkrX|j|| _|j|| _|j|| _|j|| _|j|| _qX|||< | | ¡ ¡ qX‡ fdd„|
jD ƒ}t|ƒdkr2|D ]}|j|v rz| j |j¡}| jj||	d}|  d||f ¡ |  d|||j||| jf d¡sþ|  d|j||||f ¡  d S d
}||_qz|r2t|d d … dd„ d|d d …< |sv|  d||f ¡ |  d||f d¡sv|  d||f ¡ d S t|ƒ|
_||
_t|ƒ}t ¡ }||_t |tj|¡||< |   |dt!j" ddgd| ¡râ|  d||f ¡ d S )NFc                 S   s   | j S rÊ   ©rG  ©r²   r   r   r   Ú<lambda>   rT  z:dbcheck.err_replmetadata_incorrect_attid.<locals>.<lambda>)Úkeyz
%s: 0x%08xz7ERROR: duplicate attributeID values for %s in %s on %s
zLFix %s on %s by removing the duplicate value 0x%08x for %s (keeping 0x%08x)?rN   z5Not fixing duplicate value 0x%08x for %s in %s on %s
Tc                    s   g | ]}|j ˆ vr|‘qS r   r²  )rR  r²   ©Zremove_attidr   r   rS  &  rT  z<dbcheck.err_replmetadata_incorrect_attid.<locals>.<listcomp>r   rg  z0ERROR: incorrect attributeID values in %s on %s
zEFix %s on %s by replacing incorrect value 0x%08x for %s (new 0x%08x)?rO   zANot fixing incorrect value 0x%08x with 0x%08x for %s in %s on %s
c                 S   s   | j S rÊ   r²  r³  r   r   r   r´  7  rT  z/ERROR: unsorted attributeID values in %s on %s
z+Fix %s on %s by sorting the attribute list?rP   r†  r¿   r­  z#local_oid:1.3.6.1.4.1.7165.4.3.25:0rˆ  r‰  )#r   r
   rB  rm   rh  rb   rC  r\  rD  Úreversedrµ   rG  r/   ri  r]  r“   r¨   r–   rE  rš  rF  r›  rN  r   rj  Úcountr	   r]   r­   r   r®   r¯   r°   r   r!  )rŠ   r   rr  r«  rl  rL  r1   rk  Zhash_attrm  rC  r²   rn  Znew_listro  r¯  rt  r   r¶  r   Ú err_replmetadata_incorrect_attidñ  sš    ÿÿþÿÿÿÿ
 ÿÿ
þýz(dbcheck.err_replmetadata_incorrect_attidc                 C   sˆ  d}d|vr |   d|j ¡ d}d|vs@t|d d ƒ ¡ dkrT|   d|j ¡ d}d	|vrp|   d
|j ¡ d}d|vst|d d ƒ ¡ dkr¤|   d|j ¡ d}d|v rÀ|   d|j ¡ d}d|v rôt|d d ƒ ¡ dkrô|   d|j ¡ d}d|vs<t|d ƒdks<t|d d ƒdks<t|d d ƒdkrP|   d|j ¡ d}d|vspt|d d ƒdkr„|   d|j ¡ d}|S )NFÚdescriptionz>ERROR: description not present on Deleted Objects container %sTÚshowInAdvancedViewOnlyr   ÚFALSEzIERROR: showInAdvancedViewOnly not present on Deleted Objects container %sÚobjectCategoryzAERROR: objectCategory not present on Deleted Objects container %sÚisCriticalSystemObjectzIERROR: isCriticalSystemObject not present on Deleted Objects container %sÚ
isRecycledz9ERROR: isRecycled present on Deleted Objects container %srV  z8ERROR: isDeleted not set on Deleted Objects container %sr}  r•  Útopr(   Ú	containerzBERROR: objectClass incorrectly set on Deleted Objects container %sÚsystemFlagsú-1946157056zBERROR: systemFlags incorrectly set on Deleted Objects container %s)r“   r   r   r^  r   )rŠ   r  Zfaultyr   r   r   Úis_deleted_deleted_objectsP  s<       ÿþ z"dbcheck.is_deleted_deleted_objectsc                 C   s2  t  ¡ }|j |_}d|vr0t  dt jd¡|d< d|vrLt  dt jd¡|d< d|vrnt  d| j t jd¡|d< d|vrŠt  dt jd¡|d< d|v r¦t  dt jd¡|d< t  dt jd	¡|d	< t  d
t jd¡|d< t  ddgt jd¡|d< |  d| d¡s
|  d| ¡ d S |  	|dgd| ¡r.|  d| ¡ d S )Nrº  zContainer for deleted objectsr»  rY  r½  zCN=Container,%sr¾  r¿  rV  rÃ  rÂ  rÀ  rÁ  r}  zAFix Deleted Objects container %s by restoring default attributes?rQ   ú.Not fixing missing/incorrect attributes on %s
r¡   z+Failed to fix Deleted Objects container  %sz%Fixed Deleted Objects container '%s'
)
r]   r­   r   r®   r¯   rb   rÎ   r¨   r“   r°   )rŠ   r  rt  r   r   r   r   Úerr_deleted_deleted_objectsn  s4    ÿÿ
ÿz#dbcheck.err_deleted_deleted_objectsc                 C   s¤   t  ¡ }||_| j ¡ }| j ¡ r:|  d||jf ¡ d S |  d|j d¡s`|  d|j ¡ d S t  |t j	|¡||< |  
|g d||jf ¡r |  d||jf ¡ d S )NzNot fixing %s %s for the RODCz-Add yourself to the replica locations for %s?rj   rÅ  zFailed to add %s for %szFixed %s for %s)r]   r­   r   r.   rd   Úam_rodcr“   r¨   r®   rÕ   r°   )rŠ   r  Z	cross_refrr  rt  Útargetr   r   r   Úerr_replica_locationsŠ  s     

ÿÿzdbcheck.err_replica_locationsc                 C   sL   || j jkrdS || jkrdS || jkr,dS || jkr:dS || jkrHdS dS )NTF)r.   r_   r`   ra   rb   rc   rä   r   r   r   Úis_fsmo_roleœ  s    



zdbcheck.is_fsmo_rolec              
   C   sº   d}| j  |¡}||krŠ|tjO }z | j j| ¡ tjg dgd W n< tjy~ } z"|j	\}}|tj
krj‚ W Y d }~nd }~0 0 |tjO }| jd ur¶t|ƒdd„ | jD ƒv r¶|tjO }|S )Nr   rž   r‘   c                 S   s   g | ]}t |ƒ‘qS r   rU  )rR  Úxr   r   r   rS  ·  rT  z2dbcheck.calculate_instancetype.<locals>.<listcomp>)r.   rã   r   ZINSTANCE_TYPE_IS_NC_HEADrq   r  r]   rr   rt   ru   rv   ZINSTANCE_TYPE_NC_ABOVErz   r   ZINSTANCE_TYPE_WRITE)rŠ   r   Úinstancetyperî   Ze4rŒ   r   r   r   r   Úcalculate_instancetypeª  s    
 


"
zdbcheck.calculate_instancetypec                 C   sJ   | j D ]:\}}||krt | j ¡ ¡}ttj||| jdƒ  S qt‚d S )N)rp   )	rg   r   rs   r.   rx   r   r~  rp   r~   )rŠ   r   Zsd_dnZdescriptor_fnZ
domain_sidr   r   r   Úget_wellknown_sd¼  s    ÿÿ
zdbcheck.get_wellknown_sdc           >      C   s€  | j r|  d| ¡ |du r$dg}nt|ƒ}dttj|ƒv rF| d¡ dttj|ƒv r`| d¡ t| ¡ ƒ ¡ ttj|ƒv r†| d¡ dttj|ƒv r¸| | ¡ ¡ | d¡ | d¡ d	}d|v rÊd
}n4|D ].}|  |¡\}}|dkrêqÎ|d@ rôqÎd
} qþqÎ|r| d¡ | d¡ zTd}|t	j
O }|t	jO }|t	jO }|t	jO }| jj|tjdddd| dg|d}W nr tjyÞ }	 zV|	j\}
}|
tjkrÈ| jrº|  d| ¡ W Y d}	~	dS W Y d}	~	dS ‚ W Y d}	~	n
d}	~	0 0 t|ƒdkr |  d| ¡ dS |d }d}tƒ }tƒ }d	}| j |j¡}z| j |tjj¡}W n tyX   d}Y n0 d}d}d}d	}d}d}|D ]r}t|ƒ ¡ dkr¦t|| d ƒdkr¦d
}t|ƒ ¡ dkrÈt|| d ƒ}t|ƒ ¡ dkrv|| d }qv|r.|r.|   ||¡r|d7 }|  !||¡ |S |  "||¡r.|S |D ]*}|dks2|dkrPq2t|ƒ ¡ dkrfd
}t|ƒ ¡ dkrÆt|| ƒdkr¶|d7 }|  dt|| ƒ|t|jƒf ¡ nt|| d ƒ}t|ƒ ¡ t|j ¡ ƒ ¡ kr8|}t|| ƒdkr(|d7 }|  dt|| ƒ|t|jƒf ¡ nt|| d ƒ}t|ƒ ¡ dkrR|  #||| d ¡r~|d7 }|  $|||| d ¡ z|  %||| d ¡\}}}W n4 tyÐ   |d7 }|  &|||| ¡ Y q2Y n0 t|ƒt|ƒk s t|ƒdks t'|ƒ|kr"|d7 }|  (|||| d |¡ n,|d dkr2|d7 }|  d|t|ƒf ¡ q2t|ƒ ¡ dkrP|  )||¡\}}|dur˜|  *|||¡ |d7 }q2|j+du s°|j,du rÈ|  -||¡ |d7 }q2| j.r2z|  /|¡}W n tyø   Y q2Y n0 t0t	j1|| d ƒ}t2||t	 3| j 4¡ ¡ƒ} | d kr2|  5|||| ¡ |d7 }q2q2t|ƒ ¡ dkrÜ| j 6| j7||| ¡}!t'|!ƒt'|| ƒksº|!d || d ksº|!d! || d! kr2|  8||t|| ƒ¡ |d7 }q2t|ƒ ¡ d"krèt|| d ƒdkr<|| d d d#kr<|d7 }|  9|||| ¡ q2n¬|| d dd$… d%kr^q2nŠ|| d dd&… d'krš|d7 }|  :|||| ¡ q2nN|| d d dkr(|| d d( dkr(|| d d) dkr(|| d d* dkr(|| d d+ dkr(|d7 }|  ;|||| ¡ q2nÀt|| d ƒd, dkr\|d7 }|  <||¡ q2nŒ|| d d dkrè|| d d, dkrè|| d d( dkrè|| d d- dkrè|| d d) dkrè|d7 }|  =|||| ¡ q2| ¡ d.k	s| ¡ d/k	rT|| d | j>v 	r@|d7 }|  d0||j|| d f ¡ n| j> ?|| d ¡ || D ](}"|"d1k	r\|  @||¡ |d7 }	q\	q\z| j7 A|¡}#W nH tB	yÞ }$ z.|  C||¡ |d7 }W Y d}$~$q2W Y d}$~$n
d}$~$0 0 |  |¡\}}%| j7 D|¡}&|&tjE@ 
s*|&tjF@ 
s*|
s*| ?t|ƒ ¡ ¡ |#tjGtjHtjItjJfv 
rX||  K|||#¡7 }n¬tƒ }'|| D ]`}"|' ?|"¡ | j 6| j7||"g¡}!t|!ƒdk
s¤|!d |"k
rf|  L|||| ¡ |d7 } 
qÈ
qft|| ƒt|'ƒkr|  M|||| t|'ƒ¡ |d7 } q`t|ƒ ¡ d2kr2|  N|¡}(t|d3 ƒdksHt|d3 d ƒ|(kr2|d7 }|  O||(¡ q2|s”d|v s‚dttj|ƒv r”|d7 }|  P|¡ d|v s°dttj|ƒv r|du rÖ|d7 }|  d4t|jƒ ¡ |du r|d7 }|  d5|j ¡ t|jƒf ¡ |durìd})dd6g}*|rD|tjjQ@ s4|})|*d7tjR g7 }*|)du rX|j S¡ })t T| jd8|) ¡}+|+ Ud|j ¡ |¡ |j|kr|j}+|+|jkrº|d7 }|  V||+||||*¡ n2|j W¡ |krì|d7 }|  d9||t|jƒf ¡ d
},|rö|j|kr†d:}-d;}.|  X||-¡}/|/|.kr†|  Yd<t|ƒ d=¡rtt Z¡ }0||0_t [d>tj\d¡|0d< |d7 }| jj]|0d?gd@ n|  dAt|ƒ ¡ | ^|¡D ]d}1|,r¬|  dB| ¡ d	},|d7 }|  dC|1 ¡ |  YdD|1 dE¡sæ|  dF|1 ¡ q|  _||1¡ q|  `|¡r:dG|vr:d|v s(dHttj|ƒv r:|  a|¡ |d7 }zD|| j b¡ kr|t| S¡ ƒ| jcvr|| jj| S¡ tjddgdI}W nv tjyô }2 zZ|2j\}
}|
tjkrÞ|rÊ|  dJ|j ¡ |  dK¡ n|  d|¡ |d7 }n‚ W Y d}2~2n
d}2~20 0 || jev r*d|v r*|  f|¡r*|  g|¡ |d7 }| jhD ]¢\}3}$||3kr0dL|v r0dM}4| j i¡ r`dN}4|4|$vr†|  j||$j|4¡ |d7 }q0d	}5|$|4 D ]}6t|6ƒ| j k¡ kr’d
}5q’|5s0|  j||$j|4¡ |d7 }q0|| jlkrtd|v sôdO|v rtdO|vrt|d7 }| jmrZ|  YdPdQ¡rt| j n¡  z| j o¡  W n   | j p¡  ‚ Y n0 | j q¡  n| j i¡ st|  dR| ¡ || jrkr|| jj| jrtjg dS¢dT}dU|d vrÂ|  dV| ¡ |d7 }nºt|d dU d ƒ}7dW|7@ d#? }8dX|7@ }9|8|9kr|  dY|9|8|9|8f ¡ |d7 }dZ|d v r6t|d dZ d ƒ}:nd}:|:dkrJ|9}:n|:d7 }:|:|8kr|d[| j 4¡ |:f };z| jjd\|; tjg dT}W nD tjyÎ }< z(|<j\}
}|
tjkr¶‚ d}W Y d}<~<n
d}<~<0 0 |durp|  d]|;|d j|f ¡ |d7 }|  Yd^|;|f d_¡r|| j n¡  z(| j s¡ }=|=|:kr|=d }:qBqW n   | j p¡  ‚ Y n0 | j q¡  nq|n|:d7 }:qR|S )`zcheck one objectúChecking object %sNÚ*r   ÚnameZdistinguishednamerV  rÂ  FTr   r(   rW  r=  r   rž   rœ   r‡  rŸ   )r!   r"   r’   r#   z)ERROR: Object %s disappeared during checkz,ERROR: Object %s failed to load during checkZ	isdeletedr¼  ZsystemflagsZreplpropertymetadataZdistinguishedNameZobjectclassz1ERROR: Not fixing num_values(%d) for '%s' on '%s'zYERROR: Not fixing incorrect initial attributeID in '%s' on '%s', it should be objectClassZntsecuritydescriptorr   rê   Zuserparametersé    é   s                   é   s   IAAgACAAIAAgACAAIAAgé   é   é   é	   r•  é   ZattributeidZ	governsidz@Error: %s %s on %s already exists as an attributeId or governsIdrT  rÌ  r   z(ERROR: Not fixing missing 'name' on '%s'z&ERROR: Not fixing missing '%s' on '%s'r¡   rú   z
RDN=RDN,%szERROR: Not fixing %s=%r on '%s'i0  l   €)¨x1cB& z-Fix isDeleted originating_change_time on '%s'r?   rY  r¤   r¥   z4Not fixing isDeleted originating_change_time on '%s'zOn object %sz7ERROR: Attribute %s not present in replication metadataz-Fix missing replPropertyMetaData element '%s'r>   z4Not fixing missing replPropertyMetaData element '%s'r  Zfsmoroleowner)r!   r"   r’   z'WARNING: parent object not found for %szFNot moving to LostAndFound (tombstone garbage collection in progress?)ZrepsFromr%   r&   r)   z,Allocate the missing RID set for RID master?rk   z^No RID Set found for this server: %s, and we are not the RID Master (so can not self-allocate))ÚrIDAllocationPoolZrIDPreviousAllocationPoolZrIDUsedPoolÚ
rIDNextRIDr    rÚ  z No rIDAllocationPool found in %sl       üÿ l   ÿÿ zInvalid RID set %d-%s, %d > %d!rÛ  z%s-%dz<SID=%s>z6SID %s for %s conflicts with our current RID set in %szGFix conflict between SID %s and RID pool in %s by allocating a new RID?rV   )tr0   r“   rÜ   Úmapr   r]  rƒ   r§  rÍ   r   r  r  rŠ  r‹  r.   rq   r]   rr   rt   ru   rv   r\   r   rm   rã   r   r€   r–  r   r‚   r~   r‰   r¦  r¨  rŸ  r¬  r°  rp  r±  r\  r¹  r…  rŽ  r  r€  r“  rX   rÎ  r   r~  r   rs   rx   r’  rÓ   r/   rÝ   r%  r)  r-  r/  r.  r•   r–   rÏ   r0  rÃ   r  Z$get_systemFlags_from_lDAPDisplayNameZDS_FLAG_ATTR_NOT_REPLICATEDZDS_FLAG_ATTR_IS_CONSTRUCTEDr«   ZDSDB_SYNTAX_OR_NAMEZDSDB_SYNTAX_STRING_DNr@  rd  rÚ   rß   rÍ  r#  rå   Z#SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETErû   r  r^   Zset_componentr  Zget_rdn_valuerf  r¨   r­   r®   r¯   rÇ   Ú
differenceru  rÊ  r  r„   rn   r  r{   rÄ  rÆ  r}   rÇ  rÉ  rd   r†   r…   r  Zcreate_own_rid_setr  r  r‡   Zallocate_rid)>rŠ   r   r#   Zneed_replPropertyMetaDataÚarÌ   rì   r  r‹   Ze10rŒ   r   r  r™   Zset_attrs_from_mdZset_attrs_seenZgot_objectclassZnc_dnZdeleted_objects_dnZobject_rdn_attrZobject_rdn_valr  rV  rÂ  Zrepl_meta_data_valrË   Zlist_attid_from_mdrl  r„  rŒ  Zwell_known_sdZ
current_sdr‘  rØ   r×   r1  r¶   rí   ÚflagrÖ   r"  Z	parent_dnr’   Zexpected_dnZshow_dnZisDeletedAttIdZexpectedTimeDoZoriginatingrt  rn  Ze11Zdns_partÚlocationr   ZlocZ	next_poolZhighZlowZnext_free_ridZsidrï   Zallocated_ridr   r   r   r—   Æ  s   










ûø
	
ÿ

ÿ ÿÿ
ÿ
þ
ÿ

ÿ
ÿþ,nnÿ
$ÿþ
ÿ


("






ÿ
&
$ÿ






ÿ

ÿ


ÿ


ÿþ
	


zdbcheck.check_objectc                 C   sB  t  | jd¡}| jr"|  d| ¡ | jj|t jd}t|ƒdkrR|  d| ¡ dS |d }d}d|vrx|  d¡ |d S t|d d ƒ 	d	¡s>|  d
¡ |d7 }|  
d¡s°|S | jjt  | j|d d  d¡¡t jdgd}tttj|d d d ƒƒ}t  ¡ }||_t  d| t jd¡|d< | j|g dddr>|  d¡ |S )z!check the @ROOTDSE special objectz@ROOTDSErÏ  )r!   r"   r(   z"Object %s disappeared during checkr   r  z(ERROR: dsServiceName missing in @ROOTDSEz<GUID=z1ERROR: dsServiceName not in GUID form in @ROOTDSEz"Change dsServiceName to GUID form?r$   r=  r    rX  z+Failed to change dsServiceName to GUID formFr¦   z"Changed dsServiceName to GUID form)r]   r^   r.   r0   r“   rq   rr   r   r   Ú
startswithrº   r   r   r   r    r­   r   r®   r¯   r°   )rŠ   r   r‹   r  r™   rs  rÈ   r   r   r   r˜   Ñ
  s:    


 ÿ
ÿ
zdbcheck.check_rootdsec                 C   sR   t  ¡ }t  | jd¡|_t  dt jd¡|d< t  dt jd¡|d< | j|g dddS )	zre-index the whole databasez@ATTRIBUTESr»   Zforce_reindexr–   rÂ   zre-indexed databaseFr¦   )	r]   r­   r^   r.   r   r®   rÕ   rÎ   r°   ©rŠ   rÈ   r   r   r   Úreindex_databaseõ
  s
    zdbcheck.reindex_databasec                 C   s>   t  ¡ }t  | jd¡|_t  dt jd¡|d< | j|g dddS )zOreset @MODULES to that needed for current sam.ldb (to read a very old database)z@MODULESZ
samba_dsdbz@LISTzreset @MODULES on databaseFr¦   )r]   r­   r^   r.   r   r®   r¯   r°   râ  r   r   r   Úreset_modulesÿ
  s    zdbcheck.reset_modules)	NFFFFFFFF)FF)T)F)T)N)MÚ__name__Ú
__module__Ú__qualname__Ú__doc__r   r]   rA  r›   r”   r“   rº   r¨   rÅ   r°   rÉ   rÍ   rÏ   rÚ   rÝ   rß   r¬   rå   ré   rð   r÷   rø   rü   rý   r  r  r  r  r
  r  r  r  r  r  r#  r%  r)  r-  r.  r/  r2  r<  r  rO  rd  re  rf  rp  ru  ry  r{  r…  rŽ  r’  r“  rŸ  r¡  r¦  r¨  r¬  r°  r±  r¹  rÄ  rÆ  rÉ  rÊ  rÍ  rÎ  r—   r˜   rã  rä  r   r   r   r   r   :   s®        ü
 :ÿ
d



U   þ
#A!f  ,i6"$%_

    $
r   ) Z
__future__r   r]   r–  r˜  Úbase64r   r   r   Zsamba.dcerpcr   r   Z	samba.ndrr   r	   r
   Zsamba.samdbr   r   Zsamba.descriptorr   r   Z
samba.authr   r   Zsamba.netcmdr   Zsamba.netcmd.fsmor   r   rš   r   r   r   r   r   Ú<module>   s$   