def fix_old_dc_references(self, samdb):
'''Fixes attributes that reference the old/removed DCs'''
# we just want to fix up DB problems here that were introduced by us
# removing the old DCs. We restrict what we fix up so that the restored
# DB matches the backed-up DB as close as possible. (There may be other
# DB issues inherited from the backed-up DC, but it's not our place to
# silently try to fix them here).
samdb.transaction_start()
chk = dbcheck(samdb,
quiet=True,
fix=True,
yes=False,
in_transaction=True)
# fix up stale references to the old DC
setattr(chk, 'fix_all_old_dn_string_component_mismatch', 'ALL')
attrs = ['lastKnownParent', 'interSiteTopologyGenerator']
# fix-up stale one-way links that point to the old DC
setattr(chk, 'remove_plausible_deleted_DN_links', 'ALL')
attrs += ['msDS-NC-Replica-Locations']
cross_ncs_ctrl = 'search_options:1:2'
controls = ['show_deleted:1', cross_ncs_ctrl]
chk.check_database(controls=controls, attrs=attrs)
samdb.transaction_commit()
def test_offline_manual_seized_ridalloc_with_dbcheck(self):
"""Peform the same actions as test_offline_samba_tool_seized_ridalloc,
but do not create the RID set. Confirm that dbcheck correctly creates
the RID Set.
Also check
"""
fsmo_dn = ldb.Dn(self.ldb_dc1, "CN=RID Manager$,CN=System," + self.ldb_dc1.domain_dn())
(fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
targetdir = self._test_join(fsmo_not_owner['dns_name'], "RIDALLOCTEST2")
try:
# Connect to the database
ldb_url = "tdb://%s" % os.path.join(targetdir, "private/sam.ldb")
lp = self.get_loadparm()
new_ldb = SamDB(ldb_url, credentials=self.get_credentials(),
session_info=system_session(lp), lp=lp)
serviceName = new_ldb.get_dsServiceName()
m = ldb.Message()
m.dn = fsmo_dn
m["fSMORoleOwner"] = ldb.MessageElement(serviceName,
ldb.FLAG_MOD_REPLACE,
"fSMORoleOwner")
new_ldb.modify(m)
# 1. Get server name
res = new_ldb.search(base=ldb.Dn(new_ldb, new_ldb.get_serverName()),
scope=ldb.SCOPE_BASE, attrs=["serverReference"])
# 2. Get server reference
server_ref_dn = ldb.Dn(new_ldb, res[0]['serverReference'][0])
# Assert that no RID Set has been set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDSetReferences'])
self.assertFalse("rIDSetReferences" in res[0])
smbconf = os.path.join(targetdir, "etc/smb.conf")
chk = dbcheck(new_ldb, verbose=False, fix=True, yes=True, quiet=True)
self.assertEqual(chk.check_database(DN=server_ref_dn, scope=ldb.SCOPE_BASE), 1, "Should have fixed one error (missing RID Set)")
# 3. Assert we get the RID Set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDSetReferences'])
self.assertTrue("rIDSetReferences" in res[0])
finally:
self._test_force_demote(fsmo_not_owner['dns_name'], "RIDALLOCTEST2")
shutil.rmtree(targetdir, ignore_errors=True)
def test_offline_manual_seized_ridalloc_with_dbcheck(self):
"""Peform the same actions as test_offline_samba_tool_seized_ridalloc,
but do not create the RID set. Confirm that dbcheck correctly creates
the RID Set.
Also check
"""
fsmo_dn = ldb.Dn(self.ldb_dc1, "CN=RID Manager$,CN=System," + self.ldb_dc1.domain_dn())
(fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
targetdir = self._test_join(fsmo_not_owner['dns_name'], "RIDALLOCTEST2")
try:
# Connect to the database
ldb_url = "tdb://%s" % os.path.join(targetdir, "private/sam.ldb")
lp = self.get_loadparm()
new_ldb = SamDB(ldb_url, credentials=self.get_credentials(),
session_info=system_session(lp), lp=lp)
serviceName = new_ldb.get_dsServiceName()
m = ldb.Message()
m.dn = fsmo_dn
m["fSMORoleOwner"] = ldb.MessageElement(serviceName,
ldb.FLAG_MOD_REPLACE,
"fSMORoleOwner")
new_ldb.modify(m)
# 1. Get server name
res = new_ldb.search(base=ldb.Dn(new_ldb, new_ldb.get_serverName()),
scope=ldb.SCOPE_BASE, attrs=["serverReference"])
# 2. Get server reference
server_ref_dn = ldb.Dn(new_ldb, res[0]['serverReference'][0].decode('utf8'))
# Assert that no RID Set has been set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDSetReferences'])
self.assertFalse("rIDSetReferences" in res[0])
smbconf = os.path.join(targetdir, "etc/smb.conf")
chk = dbcheck(new_ldb, verbose=False, fix=True, yes=True, quiet=True)
self.assertEqual(chk.check_database(DN=server_ref_dn, scope=ldb.SCOPE_BASE), 1, "Should have fixed one error (missing RID Set)")
# 3. Assert we get the RID Set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDSetReferences'])
self.assertTrue("rIDSetReferences" in res[0])
finally:
self._test_force_demote(fsmo_not_owner['dns_name'], "RIDALLOCTEST2")
shutil.rmtree(targetdir, ignore_errors=True)
def fix_old_dn_attributes(self, samdb):
'''Fixes attributes (i.e. objectCategory) that still use the old DN'''
samdb.transaction_start()
# Just fix any mismatches in DN detected (leave any other errors)
chk = dbcheck(samdb, quiet=True, fix=True, yes=False,
in_transaction=True)
# fix up incorrect objectCategory/etc attributes
setattr(chk, 'fix_all_old_dn_string_component_mismatch', 'ALL')
cross_ncs_ctrl = 'search_options:1:2'
controls = ['show_deleted:1', cross_ncs_ctrl]
chk.check_database(controls=controls)
samdb.transaction_commit()
def run(self, DN=None, H=None, verbose=False, fix=False, yes=False, cross_ncs=False, quiet=False,
scope="SUB", credopts=None, sambaopts=None, versionopts=None, attrs=None):
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp, fallback_machine=True)
samdb = SamDB(session_info=system_session(), url=H,
credentials=creds, lp=lp)
if H is None:
samdb_schema = samdb
else:
samdb_schema = SamDB(session_info=system_session(), url=None,
credentials=creds, lp=lp)
scope_map = { "SUB": ldb.SCOPE_SUBTREE, "BASE":ldb.SCOPE_BASE, "ONE":ldb.SCOPE_ONELEVEL }
scope = scope.upper()
if not scope in scope_map:
raise CommandError("Unknown scope %s" % scope)
search_scope = scope_map[scope]
controls = []
if H.startswith('ldap'):
controls.append('paged_results:1:1000')
if cross_ncs:
controls.append("search_options:1:2")
if not attrs:
attrs = ['*']
else:
attrs = attrs.split()
if yes and fix:
samdb.transaction_start()
chk = dbcheck(samdb, samdb_schema=samdb_schema, verbose=verbose, fix=fix, yes=yes, quiet=quiet)
error_count = chk.check_database(DN=DN, scope=search_scope, controls=controls, attrs=attrs)
if yes and fix:
samdb.transaction_commit()
if error_count != 0:
sys.exit(1)
def run(self, DN=None, H=None, verbose=False, fix=False, yes=False,
cross_ncs=False, quiet=False,
scope="SUB", credopts=None, sambaopts=None, versionopts=None,
attrs=None, reindex=False, force_modules=False,
reset_well_known_acls=False):
lp = sambaopts.get_loadparm()
over_ldap = H is not None and H.startswith('ldap')
if over_ldap:
creds = credopts.get_credentials(lp, fallback_machine=True)
else:
creds = None
if force_modules:
samdb = SamDB(session_info=system_session(), url=H,
credentials=creds, lp=lp, options=["modules=samba_dsdb"])
else:
try:
samdb = SamDB(session_info=system_session(), url=H,
credentials=creds, lp=lp)
except:
raise CommandError("Failed to connect to DB at %s. If this is a really old sam.ldb (before alpha9), then try again with --force-modules" % H)
if H is None or not over_ldap:
samdb_schema = samdb
else:
samdb_schema = SamDB(session_info=system_session(), url=None,
credentials=creds, lp=lp)
scope_map = { "SUB": ldb.SCOPE_SUBTREE, "BASE": ldb.SCOPE_BASE, "ONE":ldb.SCOPE_ONELEVEL }
scope = scope.upper()
if not scope in scope_map:
raise CommandError("Unknown scope %s" % scope)
search_scope = scope_map[scope]
controls = ['show_deleted:1']
if over_ldap:
controls.append('paged_results:1:1000')
if cross_ncs:
controls.append("search_options:1:2")
if not attrs:
attrs = ['*']
else:
attrs = attrs.split()
started_transaction = False
if yes and fix:
samdb.transaction_start()
started_transaction = True
try:
chk = dbcheck(samdb, samdb_schema=samdb_schema, verbose=verbose,
fix=fix, yes=yes, quiet=quiet, in_transaction=started_transaction,
reset_well_known_acls=reset_well_known_acls)
if reindex:
self.outf.write("Re-indexing...\n")
error_count = 0
if chk.reindex_database():
self.outf.write("completed re-index OK\n")
elif force_modules:
self.outf.write("Resetting @MODULES...\n")
error_count = 0
if chk.reset_modules():
self.outf.write("completed @MODULES reset OK\n")
else:
error_count = chk.check_database(DN=DN, scope=search_scope,
controls=controls, attrs=attrs)
except:
if started_transaction:
samdb.transaction_cancel()
raise
if started_transaction:
samdb.transaction_commit()
if error_count != 0:
sys.exit(1)
def test_rid_set_dbcheck_after_seize(self):
"""Perform a join against the RID manager and assert we have a RID Set.
We seize the RID master role, then using dbcheck, we assert that we can
detect out of range users (and then bump the RID set as required)."""
fsmo_dn = ldb.Dn(
self.ldb_dc1,
"CN=RID Manager$,CN=System," + self.ldb_dc1.domain_dn())
(fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
targetdir = self._test_join(fsmo_owner['dns_name'], "RIDALLOCTEST7")
try:
# Connect to the database
ldb_url = "tdb://%s" % os.path.join(targetdir, "private/sam.ldb")
smbconf = os.path.join(targetdir, "etc/smb.conf")
lp = self.get_loadparm()
new_ldb = SamDB(ldb_url,
credentials=self.get_credentials(),
session_info=system_session(lp),
lp=lp)
# 1. Get server name
res = new_ldb.search(base=ldb.Dn(new_ldb,
new_ldb.get_serverName()),
scope=ldb.SCOPE_BASE,
attrs=["serverReference"])
# 2. Get server reference
server_ref_dn = ldb.Dn(new_ldb, res[0]['serverReference'][0])
# 3. Assert we get the RID Set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE,
attrs=['rIDSetReferences'])
self.assertTrue("rIDSetReferences" in res[0])
rid_set_dn = ldb.Dn(new_ldb, res[0]["rIDSetReferences"][0])
# 4. Seize the RID Manager role
(result, out, err) = self.runsubcmd("fsmo", "seize", "--role",
"rid", "-H", ldb_url, "-s",
smbconf, "--force")
self.assertCmdSuccess(result, out, err)
self.assertEquals(err, "", "Shouldn't be any error messages")
# 5. Add a new user (triggers RID set work)
new_ldb.newuser("ridalloctestuser", "P@ssword!")
# 6. Now fetch the RID SET
rid_set_res = new_ldb.search(
base=rid_set_dn,
scope=ldb.SCOPE_BASE,
attrs=['rIDNextRid', 'rIDAllocationPool'])
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
last_rid = (0xFFFFFFFF00000000 & next_pool) >> 32
# 7. Add user above the ridNextRid and at almost the end of the range.
#
m = ldb.Message()
m.dn = ldb.Dn(new_ldb, "CN=ridsettestuser2,CN=Users")
m.dn.add_base(new_ldb.get_default_basedn())
m['objectClass'] = ldb.MessageElement('user', ldb.FLAG_MOD_ADD,
'objectClass')
m['objectSid'] = ldb.MessageElement(
ndr_pack(
security.dom_sid(
str(new_ldb.get_domain_sid()) + "-%d" %
(last_rid - 3))), ldb.FLAG_MOD_ADD, 'objectSid')
new_ldb.add(m, controls=["relax:0"])
# 8. Add user above the ridNextRid and at the end of the range
m = ldb.Message()
m.dn = ldb.Dn(new_ldb, "CN=ridsettestuser3,CN=Users")
m.dn.add_base(new_ldb.get_default_basedn())
m['objectClass'] = ldb.MessageElement('user', ldb.FLAG_MOD_ADD,
'objectClass')
m['objectSid'] = ldb.MessageElement(
ndr_pack(
security.dom_sid(
str(new_ldb.get_domain_sid()) + "-%d" % last_rid)),
ldb.FLAG_MOD_ADD, 'objectSid')
new_ldb.add(m, controls=["relax:0"])
chk = dbcheck(new_ldb,
verbose=False,
fix=True,
yes=True,
quiet=True)
# Should have fixed two errors (wrong ridNextRid)
self.assertEqual(
chk.check_database(DN=rid_set_dn, scope=ldb.SCOPE_BASE), 2)
# 9. Assert we get didn't show any other errors
chk = dbcheck(new_ldb, verbose=False, fix=False, quiet=True)
# 10. Add another user (checks RID rollover)
# We have seized the role, so we can do that.
new_ldb.newuser("ridalloctestuser3", "P@ssword!")
rid_set_res = new_ldb.search(
base=rid_set_dn,
scope=ldb.SCOPE_BASE,
attrs=['rIDNextRid', 'rIDAllocationPool'])
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
self.assertNotEqual(last_rid,
(0xFFFFFFFF00000000 & next_pool) >> 32,
"rid pool should have changed")
finally:
self._test_force_demote(fsmo_owner['dns_name'], "RIDALLOCTEST7")
shutil.rmtree(targetdir, ignore_errors=True)
def test_rid_set_dbcheck(self):
"""Perform a join against the RID manager and assert we have a RID Set.
Using dbcheck, we assert that we can detect out of range users."""
fsmo_dn = ldb.Dn(
self.ldb_dc1,
"CN=RID Manager$,CN=System," + self.ldb_dc1.domain_dn())
(fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
targetdir = self._test_join(fsmo_owner['dns_name'], "RIDALLOCTEST6")
try:
# Connect to the database
ldb_url = "tdb://%s" % os.path.join(targetdir, "private/sam.ldb")
smbconf = os.path.join(targetdir, "etc/smb.conf")
lp = self.get_loadparm()
new_ldb = SamDB(ldb_url,
credentials=self.get_credentials(),
session_info=system_session(lp),
lp=lp)
# 1. Get server name
res = new_ldb.search(base=ldb.Dn(new_ldb,
new_ldb.get_serverName()),
scope=ldb.SCOPE_BASE,
attrs=["serverReference"])
# 2. Get server reference
server_ref_dn = ldb.Dn(new_ldb, res[0]['serverReference'][0])
# 3. Assert we get the RID Set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE,
attrs=['rIDSetReferences'])
self.assertTrue("rIDSetReferences" in res[0])
rid_set_dn = ldb.Dn(new_ldb, res[0]["rIDSetReferences"][0])
# 4. Add a new user (triggers RID set work)
new_ldb.newuser("ridalloctestuser", "P@ssword!")
# 5. Now fetch the RID SET
rid_set_res = new_ldb.search(
base=rid_set_dn,
scope=ldb.SCOPE_BASE,
attrs=['rIDNextRid', 'rIDAllocationPool'])
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
last_rid = (0xFFFFFFFF00000000 & next_pool) >> 32
# 6. Add user above the ridNextRid and at mid-range.
#
# We can do this with safety because this is an offline DB that will be
# destroyed.
m = ldb.Message()
m.dn = ldb.Dn(new_ldb, "CN=ridsettestuser1,CN=Users")
m.dn.add_base(new_ldb.get_default_basedn())
m['objectClass'] = ldb.MessageElement('user', ldb.FLAG_MOD_ADD,
'objectClass')
m['objectSid'] = ldb.MessageElement(
ndr_pack(
security.dom_sid(
str(new_ldb.get_domain_sid()) + "-%d" %
(last_rid - 10))), ldb.FLAG_MOD_ADD, 'objectSid')
new_ldb.add(m, controls=["relax:0"])
# 7. Check the RID Set
chk = dbcheck(new_ldb,
verbose=False,
fix=True,
yes=True,
quiet=True)
# Should have one error (wrong rIDNextRID)
self.assertEqual(
chk.check_database(DN=rid_set_dn, scope=ldb.SCOPE_BASE), 1)
# 8. Assert we get didn't show any other errors
chk = dbcheck(new_ldb, verbose=False, fix=False, quiet=True)
rid_set_res = new_ldb.search(
base=rid_set_dn,
scope=ldb.SCOPE_BASE,
attrs=['rIDNextRid', 'rIDAllocationPool'])
last_allocated_rid = int(rid_set_res[0]["rIDNextRid"][0])
self.assertEquals(last_allocated_rid, last_rid - 10)
# 9. Assert that the range wasn't thrown away
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
self.assertEqual(last_rid, (0xFFFFFFFF00000000 & next_pool) >> 32,
"rid pool should have changed")
finally:
self._test_force_demote(fsmo_owner['dns_name'], "RIDALLOCTEST6")
shutil.rmtree(targetdir, ignore_errors=True)
def test_rid_set_dbcheck_after_seize(self):
"""Perform a join against the RID manager and assert we have a RID Set.
We seize the RID master role, then using dbcheck, we assert that we can
detect out of range users (and then bump the RID set as required)."""
fsmo_dn = ldb.Dn(self.ldb_dc1, "CN=RID Manager$,CN=System," + self.ldb_dc1.domain_dn())
(fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
targetdir = self._test_join(fsmo_owner['dns_name'], "RIDALLOCTEST7")
try:
# Connect to the database
ldb_url = "tdb://%s" % os.path.join(targetdir, "private/sam.ldb")
smbconf = os.path.join(targetdir, "etc/smb.conf")
lp = self.get_loadparm()
new_ldb = SamDB(ldb_url, credentials=self.get_credentials(),
session_info=system_session(lp), lp=lp)
# 1. Get server name
res = new_ldb.search(base=ldb.Dn(new_ldb, new_ldb.get_serverName()),
scope=ldb.SCOPE_BASE, attrs=["serverReference"])
# 2. Get server reference
server_ref_dn = ldb.Dn(new_ldb, res[0]['serverReference'][0])
# 3. Assert we get the RID Set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDSetReferences'])
self.assertTrue("rIDSetReferences" in res[0])
rid_set_dn = ldb.Dn(new_ldb, res[0]["rIDSetReferences"][0])
# 4. Seize the RID Manager role
(result, out, err) = self.runsubcmd("fsmo", "seize", "--role", "rid", "-H", ldb_url, "-s", smbconf, "--force")
self.assertCmdSuccess(result, out, err)
self.assertEquals(err,"","Shouldn't be any error messages")
# 5. Add a new user (triggers RID set work)
new_ldb.newuser("ridalloctestuser", "P@ssword!")
# 6. Now fetch the RID SET
rid_set_res = new_ldb.search(base=rid_set_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDNextRid',
'rIDAllocationPool'])
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
last_rid = (0xFFFFFFFF00000000 & next_pool) >> 32
# 7. Add user above the ridNextRid and at almost the end of the range.
#
m = ldb.Message()
m.dn = ldb.Dn(new_ldb, "CN=ridsettestuser2,CN=Users")
m.dn.add_base(new_ldb.get_default_basedn())
m['objectClass'] = ldb.MessageElement('user', ldb.FLAG_MOD_ADD, 'objectClass')
m['objectSid'] = ldb.MessageElement(ndr_pack(security.dom_sid(str(new_ldb.get_domain_sid()) + "-%d" % (last_rid - 3))),
ldb.FLAG_MOD_ADD,
'objectSid')
new_ldb.add(m, controls=["relax:0"])
# 8. Add user above the ridNextRid and at the end of the range
m = ldb.Message()
m.dn = ldb.Dn(new_ldb, "CN=ridsettestuser3,CN=Users")
m.dn.add_base(new_ldb.get_default_basedn())
m['objectClass'] = ldb.MessageElement('user', ldb.FLAG_MOD_ADD, 'objectClass')
m['objectSid'] = ldb.MessageElement(ndr_pack(security.dom_sid(str(new_ldb.get_domain_sid()) + "-%d" % last_rid)),
ldb.FLAG_MOD_ADD,
'objectSid')
new_ldb.add(m, controls=["relax:0"])
chk = dbcheck(new_ldb, verbose=False, fix=True, yes=True, quiet=True)
# Should have fixed two errors (wrong ridNextRid)
self.assertEqual(chk.check_database(DN=rid_set_dn, scope=ldb.SCOPE_BASE), 2)
# 9. Assert we get didn't show any other errors
chk = dbcheck(new_ldb, verbose=False, fix=False, quiet=True)
# 10. Add another user (checks RID rollover)
# We have seized the role, so we can do that.
new_ldb.newuser("ridalloctestuser3", "P@ssword!")
rid_set_res = new_ldb.search(base=rid_set_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDNextRid',
'rIDAllocationPool'])
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
self.assertNotEqual(last_rid, (0xFFFFFFFF00000000 & next_pool) >> 32, "rid pool should have changed")
finally:
self._test_force_demote(fsmo_owner['dns_name'], "RIDALLOCTEST7")
shutil.rmtree(targetdir, ignore_errors=True)
def test_rid_set_dbcheck(self):
"""Perform a join against the RID manager and assert we have a RID Set.
Using dbcheck, we assert that we can detect out of range users."""
fsmo_dn = ldb.Dn(self.ldb_dc1, "CN=RID Manager$,CN=System," + self.ldb_dc1.domain_dn())
(fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
targetdir = self._test_join(fsmo_owner['dns_name'], "RIDALLOCTEST6")
try:
# Connect to the database
ldb_url = "tdb://%s" % os.path.join(targetdir, "private/sam.ldb")
smbconf = os.path.join(targetdir, "etc/smb.conf")
lp = self.get_loadparm()
new_ldb = SamDB(ldb_url, credentials=self.get_credentials(),
session_info=system_session(lp), lp=lp)
# 1. Get server name
res = new_ldb.search(base=ldb.Dn(new_ldb, new_ldb.get_serverName()),
scope=ldb.SCOPE_BASE, attrs=["serverReference"])
# 2. Get server reference
server_ref_dn = ldb.Dn(new_ldb, res[0]['serverReference'][0])
# 3. Assert we get the RID Set
res = new_ldb.search(base=server_ref_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDSetReferences'])
self.assertTrue("rIDSetReferences" in res[0])
rid_set_dn = ldb.Dn(new_ldb, res[0]["rIDSetReferences"][0])
# 4. Add a new user (triggers RID set work)
new_ldb.newuser("ridalloctestuser", "P@ssword!")
# 5. Now fetch the RID SET
rid_set_res = new_ldb.search(base=rid_set_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDNextRid',
'rIDAllocationPool'])
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
last_rid = (0xFFFFFFFF00000000 & next_pool) >> 32
# 6. Add user above the ridNextRid and at mid-range.
#
# We can do this with safety because this is an offline DB that will be
# destroyed.
m = ldb.Message()
m.dn = ldb.Dn(new_ldb, "CN=ridsettestuser1,CN=Users")
m.dn.add_base(new_ldb.get_default_basedn())
m['objectClass'] = ldb.MessageElement('user', ldb.FLAG_MOD_ADD, 'objectClass')
m['objectSid'] = ldb.MessageElement(ndr_pack(security.dom_sid(str(new_ldb.get_domain_sid()) + "-%d" % (last_rid - 10))),
ldb.FLAG_MOD_ADD,
'objectSid')
new_ldb.add(m, controls=["relax:0"])
# 7. Check the RID Set
chk = dbcheck(new_ldb, verbose=False, fix=True, yes=True, quiet=True)
# Should have one error (wrong rIDNextRID)
self.assertEqual(chk.check_database(DN=rid_set_dn, scope=ldb.SCOPE_BASE), 1)
# 8. Assert we get didn't show any other errors
chk = dbcheck(new_ldb, verbose=False, fix=False, quiet=True)
rid_set_res = new_ldb.search(base=rid_set_dn,
scope=ldb.SCOPE_BASE, attrs=['rIDNextRid',
'rIDAllocationPool'])
last_allocated_rid = int(rid_set_res[0]["rIDNextRid"][0])
self.assertEquals(last_allocated_rid, last_rid - 10)
# 9. Assert that the range wasn't thrown away
next_pool = int(rid_set_res[0]["rIDAllocationPool"][0])
self.assertEqual(last_rid, (0xFFFFFFFF00000000 & next_pool) >> 32, "rid pool should have changed")
finally:
self._test_force_demote(fsmo_owner['dns_name'], "RIDALLOCTEST6")
shutil.rmtree(targetdir, ignore_errors=True)
def run(self,
DN=None,
H=None,
verbose=False,
fix=False,
yes=False,
cross_ncs=False,
quiet=False,
scope="SUB",
credopts=None,
sambaopts=None,
versionopts=None,
attrs=None):
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp, fallback_machine=True)
samdb = SamDB(session_info=system_session(),
url=H,
credentials=creds,
lp=lp)
if H is None:
samdb_schema = samdb
else:
samdb_schema = SamDB(session_info=system_session(),
url=None,
credentials=creds,
lp=lp)
scope_map = {
"SUB": ldb.SCOPE_SUBTREE,
"BASE": ldb.SCOPE_BASE,
"ONE": ldb.SCOPE_ONELEVEL
}
scope = scope.upper()
if not scope in scope_map:
raise CommandError("Unknown scope %s" % scope)
search_scope = scope_map[scope]
controls = []
if H.startswith('ldap'):
controls.append('paged_results:1:1000')
if cross_ncs:
controls.append("search_options:1:2")
if not attrs:
attrs = ['*']
else:
attrs = attrs.split()
if yes and fix:
samdb.transaction_start()
chk = dbcheck(samdb,
samdb_schema=samdb_schema,
verbose=verbose,
fix=fix,
yes=yes,
quiet=quiet)
error_count = chk.check_database(DN=DN,
scope=search_scope,
controls=controls,
attrs=attrs)
if yes and fix:
samdb.transaction_commit()
if error_count != 0:
sys.exit(1)
def run(self, DN=None, H=None, verbose=False, fix=False, yes=False, cross_ncs=False, quiet=False,
scope="SUB", credopts=None, sambaopts=None, versionopts=None, attrs=None, reindex=False):
lp = sambaopts.get_loadparm()
over_ldap = H is not None and H.startswith('ldap')
if over_ldap:
creds = credopts.get_credentials(lp, fallback_machine=True)
else:
creds = None
samdb = SamDB(session_info=system_session(), url=H,
credentials=creds, lp=lp)
if H is None or not over_ldap:
samdb_schema = samdb
else:
samdb_schema = SamDB(session_info=system_session(), url=None,
credentials=creds, lp=lp)
scope_map = { "SUB": ldb.SCOPE_SUBTREE, "BASE":ldb.SCOPE_BASE, "ONE":ldb.SCOPE_ONELEVEL }
scope = scope.upper()
if not scope in scope_map:
raise CommandError("Unknown scope %s" % scope)
search_scope = scope_map[scope]
controls = ['show_deleted:1']
if over_ldap:
controls.append('paged_results:1:1000')
if cross_ncs:
controls.append("search_options:1:2")
if not attrs:
attrs = ['*']
else:
attrs = attrs.split()
started_transaction = False
if yes and fix:
samdb.transaction_start()
started_transaction = True
try:
chk = dbcheck(samdb, samdb_schema=samdb_schema, verbose=verbose,
fix=fix, yes=yes, quiet=quiet)
if reindex:
print("Re-indexing...")
error_count = 0
if chk.reindex_database():
print("completed re-index OK")
else:
error_count = chk.check_database(DN=DN, scope=search_scope,
controls=controls, attrs=attrs)
except:
if started_transaction:
samdb.transaction_cancel()
raise
if started_transaction:
samdb.transaction_commit()
if error_count != 0:
sys.exit(1)
