Commit 6bbcd3bb authored by Garming Sam's avatar Garming Sam Committed by Andrew Bartlett

dbcheck: Improve dbcheck to find (and may fix) dangling msDS-RevealedUsers

We cannot add missing backlinks because of the duplicate checking. There
seems to be no trivial way to add the bypass.
Signed-off-by: default avatarGarming Sam <garming@catalyst.net.nz>
Reviewed-by: default avatarAndrew Bartlett <abartlet@samba.org>
parent 6b242534
......@@ -973,6 +973,54 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
if v_guid == obj_guid:
match_count += 1
if match_count != 1:
reverse_syntax_oid = self.samdb_schema.get_syntax_oid_from_lDAPDisplayName(reverse_link_name)
if syntax_oid == dsdb.DSDB_SYNTAX_BINARY_DN or reverse_syntax_oid == dsdb.DSDB_SYNTAX_BINARY_DN:
if not linkID & 1:
# Forward binary multi-valued linked attribute
forward_count = 0
for w in obj[attrname]:
w_guid = dsdb_Dn(self.samdb, w).dn.get_extended_component("GUID")
if w_guid == guid:
forward_count += 1
if match_count == forward_count:
continue
error_count += 1
# Add or remove the missing number of backlinks
diff_count = forward_count - match_count
# Loop until the difference between the forward and
# the backward links is resolved.
while diff_count != 0:
if diff_count > 0:
# self.err_missing_backlink(obj, attrname,
# obj.dn.extended_str(),
# reverse_link_name,
# dsdb_dn.dn)
# diff_count -= 1
# TODO no method to fix these right now
self.report("ERROR: Can't fix missing "
"multi-valued backlinks on %s" % str(dsdb_dn.dn))
break
else:
self.err_orphaned_backlink(res[0], reverse_link_name,
obj.dn.extended_str(), attrname,
dsdb_dn.dn)
diff_count += 1
else:
# If there's a backward link on binary multi-valued linked attribute,
# let the check on the forward link remedy the value.
# UNLESS, there is no forward link detected.
if match_count == 0:
self.err_orphaned_backlink(obj, attrname,
val, reverse_link_name,
dsdb_dn.dn)
continue
error_count += 1
if linkID & 1:
# Backlink exists, but forward link does not
......
......@@ -315,3 +315,5 @@
^samba3.smb2.credits.session_setup_credits_granted.*
^samba3.smb2.credits.single_req_credits_granted.*
^samba3.smb2.credits.skipped_mid.*
^samba4.blackbox.dbcheck-links.release-4-5-0-pre1.dangling_multi_valued_dbcheck
^samba4.blackbox.dbcheck-links.release-4-5-0-pre1.dangling_multi_valued_check_missing
dn: CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
changetype: modify
delete: msDS-RevealedUsers
msDS-RevealedUsers: B:96:3700090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:<GUID=f4616422-30ec-473b-9d6f-a9a2d7bd1e6a>;<SID=S-1-5-21-4177067393-1453636373-93818738-500>;CN=Administrator,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5A00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:<GUID=f4616422-30ec-473b-9d6f-a9a2d7bd1e6a>;<SID=S-1-5-21-4177067393-1453636373-93818738-500>;CN=Administrator,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
dn: CN=dangling-multi5,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
changetype: modify
add: msDS-RevealedDSAs
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
dn: CN=dangling-multi1,CN=users,DC=release-4-5-0-pre1,DC=samba,DC=corp
objectclass: user
samaccountname: dangling-multi1
dn: CN=dangling-multi2,CN=users,DC=release-4-5-0-pre1,DC=samba,DC=corp
objectclass: user
samaccountname: dangling-multi2
dn: CN=dangling-multi3,CN=users,DC=release-4-5-0-pre1,DC=samba,DC=corp
objectclass: user
samaccountname: dangling-multi3
dn: CN=dangling-multi4,CN=users,DC=release-4-5-0-pre1,DC=samba,DC=corp
objectclass: user
samaccountname: dangling-multi4
dn: CN=dangling-multi5,CN=users,DC=release-4-5-0-pre1,DC=samba,DC=corp
objectclass: user
samaccountname: dangling-multi5
dn: CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
changetype: modify
add: msDS-RevealedUsers
msDS-RevealedUsers: B:96:3700090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi1,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:3700090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi2,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:3700090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi3,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:3700090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=Administrator,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5A00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi1,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5A00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi2,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5A00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi3,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5A00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=Administrator,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5E00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi1,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5E00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi2,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5E00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi3,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:5E00090002000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=Administrator,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:7D00090001000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi1,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:7D00090001000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi2,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:7D00090001000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=dangling-multi3,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedUsers: B:96:7D00090001000000E078C90E0300000097016C30ACF34E469BDF57F1E468694CA10E000000000000A10E000000000000:CN=Administrator,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
dn: CN=dangling-multi2,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
changetype: modify
delete: msDS-RevealedDSAs
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
dn: CN=dangling-multi3,CN=Users,DC=release-4-5-0-pre1,DC=samba,DC=corp
changetype: modify
delete: msDS-RevealedDSAs
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
msDS-RevealedDSAs: <GUID=4db69022-b1bc-46b0-a62e-3d7ff19636dc>;<SID=S-1-5-21-4177067393-1453636373-93818738-1000>;CN=DOUGLASB-DESKTO,OU=Domain Controllers,DC=release-4-5-0-pre1,DC=samba,DC=corp
......@@ -200,6 +200,78 @@ dangling_one_way() {
fi
}
dangling_multi_valued() {
# multi1 - All 4 backlinks
# multi2 - Missing all 4 backlinks
# multi3 - Missing 2 backlinks
# Administrator - Has 2 too many backlinks
# multi5 - Has 2 backlinks but no forward links
ldif=$release_dir/add-dangling-multilink-users.ldif
TZ=UTC $ldbadd -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $ldif
if [ "$?" != "0" ]; then
return 1
fi
ldif=$release_dir/add-initially-normal-multilink.ldif
TZ=UTC $ldbmodify -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $ldif
if [ "$?" != "0" ]; then
return 1
fi
ldif=$release_dir/delete-only-multi-backlink.ldif
TZ=UTC $ldbmodify -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb.d/DC%3DRELEASE-4-5-0-PRE1,DC%3DSAMBA,DC%3DCORP.ldb $ldif
if [ "$?" != "0" ]; then
return 1
fi
ldif=$release_dir/add-dangling-multi-backlink.ldif
TZ=UTC $ldbmodify -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb.d/DC%3DRELEASE-4-5-0-PRE1,DC%3DSAMBA,DC%3DCORP.ldb $ldif
if [ "$?" != "0" ]; then
return 1
fi
$PYTHON $BINDIR/samba-tool dbcheck -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --fix --yes
if [ "$?" != "1" ]; then
return 1
fi
}
dangling_multi_valued_check_missing() {
WORDS=`TZ=UTC $ldbsearch -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb '(samaccountname=dangling-multi2)' -s sub -b DC=release-4-5-0-pre1,DC=samba,DC=corp --show-deleted --reveal --sorted msDS-RevealedDSAs | grep msDS-RevealedDSAs | wc -l`
if [ $WORDS -ne 4 ]; then
echo Got only $WORDS links for dangling-multi2
return 1
fi
WORDS=`TZ=UTC $ldbsearch -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb '(samaccountname=dangling-multi3)' -s sub -b DC=release-4-5-0-pre1,DC=samba,DC=corp --show-deleted --reveal --sorted msDS-RevealedDSAs | grep msDS-RevealedDSAs | wc -l`
if [ $WORDS -ne 4 ]; then
echo Got only $WORDS links for dangling-multi3
return 1
fi
}
dangling_multi_valued_check_equal_or_too_many() {
WORDS=`TZ=UTC $ldbsearch -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb '(samaccountname=dangling-multi1)' -s sub -b DC=release-4-5-0-pre1,DC=samba,DC=corp --show-deleted --reveal --sorted msDS-RevealedDSAs | grep msDS-RevealedDSAs | wc -l`
if [ $WORDS -ne 4 ]; then
echo Got $WORDS links for dangling-multi1
return 1
fi
WORDS=`TZ=UTC $ldbsearch -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb '(samaccountname=dangling-multi5)' -s sub -b DC=release-4-5-0-pre1,DC=samba,DC=corp --show-deleted --reveal --sorted msDS-RevealedDSAs | grep msDS-RevealedDSAs | wc -l`
if [ $WORDS -ne 0 ]; then
echo Got $WORDS links for dangling-multi5
return 1
fi
WORDS=`TZ=UTC $ldbsearch -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb '(samaccountname=Administrator)' -s sub -b DC=release-4-5-0-pre1,DC=samba,DC=corp --show-deleted --reveal --sorted msDS-RevealedDSAs | grep msDS-RevealedDSAs | wc -l`
if [ $WORDS -ne 2 ]; then
echo Got $WORDS links for Administrator
return 1
fi
}
if [ -d $release_dir ]; then
testit $RELEASE undump
testit "add_two_more_users" add_two_more_users
......@@ -216,6 +288,11 @@ if [ -d $release_dir ]; then
testit "check_expected_after_objects" check_expected_after_objects
testit "dangling_one_way" dangling_one_way
testit "dbcheck_clean" dbcheck_clean
testit "dangling_multi_valued" dangling_multi_valued
testit "dangling_multi_valued_check_missing" dangling_multi_valued_check_missing
testit "dangling_multi_valued_check_equal_or_too_many" dangling_multi_valued_check_equal_or_too_many
# Currently this cannot pass
testit "dangling_multi_valued_dbcheck" dbcheck_clean
else
subunit_start_test $RELEASE
subunit_skip_test $RELEASE <<EOF
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment