
    de\                        d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlmZ d dlm	Z	 d dlm
Z
 d dlmZmZ d dlmZ d d	lmZ d d
lmZ d dlmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZmZm Z m!Z! d Z" G d de#      Z$y)    N)	b64decode	b64encode)dsdb)common)misc)drsuapi)
ndr_unpackndr_pack)drsblobs)dsdb_Dn)security)get_wellknown_sdsget_deletedobjects_descriptorget_diff_sds)system_sessionadmin_session)CommandError)get_fsmo_roleowner)c_REDc_DARK_YELLOWc_DARK_CYANc_DARK_GREENc                     g }| D ]#  }	 |j                  |j                  d             % dj	                  |      S # t        $ r |j                  t        |             Y \w xY w)zStringify a value list, using utf-8 if possible (which some tests
    want), or the python bytes representation otherwise (with leading
    'b' and escapes like b' ').
    zutf-8,)appenddecodeUnicodeDecodeErrorreprjoin)valsresultvalues      1/usr/lib/python3/dist-packages/samba/dbchecker.pydump_attr_valuesr$   *   sd    
 F '	'MM%,,w/0'
 88F " 	'MM$u+&	's    <#A"!A"c                      e Zd ZdZ	 	 	 	 	 	 dKdZdej                  ddfdZd Zd Z	dLdZ
d Zd	 ZdMd
Zd Zd Zd Zd Zd Zd Zd Zd ZdNdZd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z 	 dMdZ!d Z"d  Z#d! Z$d" Z%d# Z&d$ Z'd% Z(d& Z)d' Z*d( Z+d) Z,d* Z-d+ Z.d, Z/d- Z0d. Z1d/ Z2d0 Z3d1 Z4d2 Z5d3 Z6d4 Z7d5 Z8d6 Z9d7 Z:d8 Z;d9 Z<d: Z=d; Z>d< Z?d= Z@d> ZAd? ZBd@ ZCdA ZDdB ZEdC ZFdD ZGdE ZHdF ZIdOdGZJdH ZKdI ZLdJ ZMy)Pdbcheckzcheck a SAM database for errorsNc           
         || _         d | _        |xs || _        || _        || _        || _        || _        || _        d| _        d| _	        d| _
        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        t7               | _        d| _        d| _        d| _        d| _         d| _!        d| _"        d| _#        d| _$        d| _%        d| _&        d| _'        d| _(        d| _)        d| _*        d| _+        d| _,        d| _-        || _.        |	| _/        |
| _0        d| _1        d| _2        || _3        ti        jj                  |d|jm                         z         | _7        ti        jj                  |d|jq                         z        | _9        |ju                         | _;        ti        jj                  |d|jm                         z         | _<        ti        jj                  ||j{                               | _>        i | _?        t        | j                         | _A        d| _B        d| _C        d| _D        d| _E        d| _F        t               | _H        i | _I        i | _J        	 d|j                  |j                         t        j                        z  }|j                  |th        j                  dg      }t        t        j                  |d   d   d         }t        |      | j                  d	<   t               | _Y        t        d |j                               | _\        | j                   j                  | j|                  th        j                  d
dg      }d
|d   v r|d   d
   | _]        nd|d   v r|d   d   | _]        nd | _]        | j                   j                  dth        j                  dg      }g | _^        g | __        g | _`        	 |d   d   | _a        | j                  D ]u  }	 | j                   j                  ti        jj                  | j                   |j                  d            t        j                        }| j                  j                  |       w d| j                   j                         z  }d| j                   j                         z  }| j                   j                  th        j                  ddg| j                   j                         d|z        }t        |      dk(  r>| j                  j                  ti        jj                  | j                   |      |d   f       | j                   j                  th        j                  ddg| j                   j                         d|z        }t        |      dk(  r>| j                  j                  ti        jj                  | j                   |      |d   f       ti        jj                  | j                   d| j                   jm                         z         }t        | j                   |d      }ti        jj                  | j                   | j                   j{                               |k(  rd| _l        nd| _l        | j                   j                  ti        jj                  | j                   | j                   j                               th        j                  dg      }ti        jj                  | j                   |d   d   d   j                  d            | _n        | j                   j                  | j                  th        j                  dg      }d|d   v r>ti        jj                  | j                   |d   d   d   j                  d            | _o        nd | _o        d| j                   jq                         j                         z  }|j                  |th        j                  ddg      }d|d   v rt        |d   d   d         | _r        nd| _r        g | _s        g | _t        	 | j                   j                  th        j                  dd d!g"      }d |d   v r|d   d    | _s        d!|d   v r|d   d!   | _t        y y # th        j                  $ r.}|j                  \  }}|th        j                  k7  r Y d }~d }~ww xY w# t        $ r Y t        $ r Y w xY w# t        $ rL | j                  j                  ti        jj                  | j                   |j                  d                   Y .w xY w# th        j                  $ r-}|j                  \  }}|th        j                  k7  r Y d }~y d }~ww xY w)#NFr   zCN=Infrastructure,zCN=Partitions,%szCN=RID Manager$,CN=System,zCN=DnsAdmins,%s	objectSidbasescopeattrs	DnsAdminszmsDS-hasMasterNCshasMasterNCs namingContextsutf8zDC=DomainDnsZones,%szDC=ForestDnsZones,%smsDS-NC-Replica-LocationsmsDS-NC-RO-Replica-Locationsz$(&(objectClass=crossRef)(ncName=%s)))r+   r,   r*   
expression   ridTserverReferencerIDSetReferencesz1CN=Directory Service,CN=Windows NT,CN=Services,%sz(objectClass=nTDSService)tombstoneLifetime)r*   r+   r4   r,      z@SAMBA_DSDBcompatibleFeaturesrequiredFeatures)r+   r*   r,   )usamdbdict_oid_namesamdb_schemaverbosefixyesquietcolourremove_all_unknown_attributesremove_all_empty_attributesfix_all_normalisationfix_all_duplicatesfix_all_DN_GUIDsfix_all_binary_dn#remove_implausible_deleted_DN_links!remove_plausible_deleted_DN_links$fix_all_string_dn_component_mismatch"fix_all_GUID_dn_component_mismatch!fix_all_SID_dn_component_mismatch fix_all_SID_dn_component_missing(fix_all_old_dn_string_component_mismatchfix_all_metadatafix_time_metadatafix_undead_linked_attributesfix_all_missing_backlinksfix_all_orphaned_backlinksfix_all_missing_forward_linksdictduplicate_link_cacherecover_all_forward_linksfix_rmd_flagsfix_ntsecuritydescriptor$fix_ntsecuritydescriptor_owner_groupseize_fsmo_rolemove_to_lost_and_foundfix_instancetype"fix_replmetadata_zero_invocationid fix_replmetadata_duplicate_attidfix_replmetadata_wrong_attidfix_replmetadata_unsorted_attidfix_deleted_deleted_objectsfix_dnfix_base64_userparametersfix_utf8_userparametersfix_doubled_userparametersfix_sid_rid_set_conflictquick_membership_checksreset_well_known_aclscheck_expired_tombstonesexpired_tombstonesreset_all_well_known_aclsin_transactionldbDn	domain_dninfrastructure_dnget_config_basedn	naming_dnget_schema_basedn	schema_dnrid_dnget_dsServiceNamentds_dsaclass_schemaIDGUIDr   wellknown_sdsfix_all_missing_objectclassfix_missing_deleted_objectsfix_replica_locationsfix_missing_rid_set_masterfix_changes_after_deletion_bugsetdn_setlink_id_cachename_mapget_wellknown_dnget_default_basednr   DS_GUID_USERS_CONTAINERsearch
SCOPE_BASEr	   r   dom_sidstrLdbErrorargsERR_NO_SUCH_OBJECTr   system_session_infor   get_domain_sidadmin_session_info	write_ncsdeleted_objects_containersncs_lacking_deleted_containersdns_partitionsncsKeyError
IndexErrorr   !DS_GUID_DELETED_OBJECTS_CONTAINERr   get_root_basednSCOPE_ONELEVELget_partitions_dnlenr   is_rid_masterget_serverNameserver_ref_dn
rid_set_dnget_linearizedintr9   r;   r<   )selfr=   r?   r@   rA   rB   rC   rp   rk   rl   rm   rD   base_dnresdnsadmins_side5enumestrncdndomaindns_zoneforestdns_zonedomainforestfsmo_dn
rid_masterntds_service_dne6s                               r#   __init__zdbcheck.__init__;   s    
!)2U
-2*+0(%*""' %!&38016.49127/16.05-8=5 %!&,1)).&*/'-2*$(F!).&"(-%491$&+# %27/05-,1)/4,+0().&',$*/'(-%'>$%:"(@%"#).&,!$/CeooFW/W!X'9E<S<S<U'UV002ffU$@5??CT$TUue&=&=&?@"$.tzz:+0(+0(%*"*/'.3+e	'%*@*@050H0H0J040L0L+N NG ,,G3>>&1]  4C&x'7'7Q9LQ9OPM),]);DMM+& $2#3 "/e6J6J6L"MjjT]]#..QdftPuv#a&( V$78DN Q'!$Q!7!%jjRs~~FVEWX*,'.0+ 	1v./DH (( 	bBbZZ00

BIIfDU1V151W1WY//66r:		b 0$**2O2O2QQ/$**2L2L2NN""););*EGe)f(,

(D(D(F.TWe.e # g v;!&&tzz>(JFSTI'VW""););*EGe)f(,

(D(D(F.TWe.e # g v;!&&tzz>(JFSTI'VW&&%ADJJDXDXDZ%Z['

GUC
66$**djj::<=K!%D!&D jjSVVDJJ

8Q8Q8S%T&)nn=N<O   Q !VVDJJA7H0I!0L0S0STZ0[\ jjT%7%7&)nn=O<P   RQ'!ffTZZQ8J1KA1N1U1UV\1]^DO"DOM**668GGIJll!$&A"5!6  8 #a&(%(Q0C)DQ)G%HD"%(D""$ "	**###..)6+?+=+? $ @C $s1v-*-a&1E*F'!SV+(+A/A(B% ,G || 	77LT4s--- .	6  	 		  b33::366$**biiX^N_;`ab@ || 	77LT4s--- .	s^   Bb ?c A2c2;Ae
 c&#cc	c/#c/.c/2Aee
f
#ff
c                    | j                   j                  ||dg|      }| j                  dt        |      z         d}d| _        || j                         z  }t               | _        |D ]P  }| j                  j                  t        |j                               || j                  |j                  |      z  }R ||| j                         z  }| j                  dkD  r| j                  d| j                  z         | j                  dt        |      || j                  z   fz         | j                  dk7  r| j                  d| j                   d	       |dk7  r!| j                  s| j                  d
| d       |S )z>perform a database check, returning the number of errors foundr   r*   r+   r,   controlszChecking %u objectsr   )requested_attrszNOTICE: found %d expired tombstones, 'samba' will remove them daily, 'samba-tool domain tombstones expunge' would do that immediately.zChecked %u objects (%u errors)z	WARNING: z/ of these errors cannot be automatically fixed.z-Please use 'samba-tool dbcheck --fix' to fix z errors)r=   r   reportr   unfixable_errors check_deleted_objects_containersr   attribute_or_class_idsr   addr   r   check_objectcheck_rootdsern   rA   )r   DNr+   r   r,   r   error_countobjects           r#   check_databasezdbcheck.check_database   s    jjRuTFXV)CH45 !t<<>>&)e# 	OFKKOOC		N+4,,VYY,NNK	O :4--//K""Q&KK 5 //	1 2 	4X{T-B-BBCD 	E   A%KK)D$9$9#: ;I I J !DHHKKG&-w0 1     c           
      	   d}| j                   D ]  }|| j                  k(  r|dz  }| j                  d|z         | j                  d|z  d      sCt	        j
                  | j                  d      }|j                  |       d}	 | j                  j                  |t        j                  g g d	      }t        |      dk7  rn|d   j                  j                  d
      }t	        j
                  | j                  dt        t        j                  |            z        }|j                  |       | 	 | j                  j'                  ||g d       | j                  j                  |t        j                  dgg d	      }t        |      dk7  r| j                  d|z          y|d   d   }g }d}|D ]  }t)        | j                  |j+                  d      t,        j.                        }| j1                  |      r/| j                  d|z         |j                  j                  d
      }|j3                  t        |              |"dt        t        j                  |            z  }n+dt,        j4                  z  }|j3                  |d|       d}t7        j8                  | j                  j;                               }t=        || j>                        }tA        |      j+                  d      }| j                  jC                  d|d|d|ddg        t	        jD                         }t	        j
                  | j                  t        |d   d!               |_        t	        jF                  |t        jH                  d      |d<   | jK                  |dgd"|z  d#$      r| j                  d%|z         | jL                  j3                  |        |S # t        j                   $ rH}|j"                  \  }}	|t        j$                  k(  rn| j                  d|	z         Y d}~ yY d}~d}~ww xY w# t        j                   $ r4}
|
j"                  \  }}	| j                  d|d|d|	       Y d}
~
 yd}
~
ww xY w)&z`This function only fixes conflicts on the Deleted Objects
        containers, not the attributesr   r5   z=ERROR: NC %s lacks a reference to a Deleted Objects containerz-Fix missing Deleted Objects container for %s?r   zCN=Deleted ObjectsN)show_deleted:1extended_dn:1:1show_recycled:1reveal_internals:0r   GUIDzCN=Deleted Objects\0ACNF:%sz<Couldn't check for conflicting Deleted Objects container: %s)r   relax:0r   z/Couldn't move old Deleted Objects placeholder:  to z: wellKnownObjects)r   extended_dn:0r   r   z(wellKnownObjects was not found for NC %sr1   z7wellKnownObjects had duplicate Deleted Objects value %sz
objectGUID: %szB:32:%s:r/   r   dn: z
objectClass: top
objectClass: container
description: Container for deleted objects
isDeleted: TRUE
isCriticalSystemObject: TRUE
showInAdvancedViewOnly: TRUE
nTSecurityDescriptor:: z
systemFlags: -1946157056r   provision:0r   r   z"NC %s lacks Deleted Objects WKGUIDFvalidatezAdded %s well known guid link)'r   rx   r   confirm_allrq   rr   r=   add_baser   r   r   r   get_extended_componentr   r   r   r   r   r   renamer   r   r   DSDB_SYNTAX_BINARY_DNis_deleted_objects_dnr   r   r   r   r   r   r   r   add_ldifMessageMessageElementFLAG_MOD_REPLACE	do_modifyr   )r   r   r   r   conflict_dnr   guide2r   r   e1wkolistwkoproposed_objectguidodsdb_dnguid_suffix
wko_prefix
domain_sidsec_descsec_desc_b64deltas                         r#   r   z(dbcheck.check_deleted_objects_containers  s    55 c	7BT^^#1KKKWZ\\]##$SWY$Z\yz

$89BKKOKjj''Rs~~R2[ ( \ s8q=q699;;FCD"%&&)G#diiX\oJ^)^#`K((, &JJ%%b+7gh **##3>>+=*>.W $ XC 3x1}FKL a&+,CG"& '!$**ahhv.>@Z@Z[--g6KK Y\] ]^ +2***K*KF*S's1v&' #.03tyyAT7U3VV&)O)OO
*b9:  "))$***C*C*EFJ4Z>BmmMH$X.55f=L JJ "$\;!@ +4])C   	E KKMEvvdjj#c!fTl*;<EH(+(:(:7;>;O;O;M)OE$%
 ~~ei[BRG',  . ;b@A++2226Gc	7J ] << !wwt3111KK ^ae ef  || #%77LT4KKaceprv wxs1   B+O4P8P5-7P00P58Q?)Q::Q?c                    | j                   ry| j                  r|j                  d      rt        d      |dd z   }n|j                  d      rt	        d      |dd z   }n|j                  d      rt        d      |dd z   }nh|j                  d      rt        d      |d	d z   }nE|j                  d
      rt        d
      |dd z   }n"|j                  d      rt        d      |dd z   }t        |       y)z#print a message unless quiet is setNERROR   WARNING   INFO   NOTICE   NOTESKIPPING   )rC   rD   
startswithr   r   r   r   print)r   msgs     r#   r   zdbcheck.report  s    ::;;~~g&Gns12w.	*#I.QR8'!&)CG3)!(+c!"g5'!&)CG3
+":.QR8c
r   c                     | j                   sy| j                  r| j                  S | j                  rd}t        j                  |||      S )zconfirm a changeFTforced	allow_all)rA   rC   rB   r   confirm)r   r  r  r  s       r#   r  zdbcheck.confirm  s;    xx::88O88F~~c&IFFr   c                    | j                   syt        | |      dk(  ryt        | |      dk(  rd}n| j                  }| j                  r|S t	        j
                  ||d      }|dk(  rt        | |d       y|dk(  rt        | |d       y|S )z(confirm a change with support for "all" FNONEALLTr  )rA   getattrrB   rC   r   r  setattr)r   r  all_attrr  cs        r#   r   zdbcheck.confirm_all  s    xx4"f,4"e+FXXF::MNN3v>:D(E*;D(F+r   c                 >   | j                   r| j                  d|z         	 |dt        j                  z  gz   }| j                  j                  ||       y# t        $ r<}| j                  rt        |d|      | j                  |d|       Y d}~yd}~ww xY w)z&delete dn with optional verbose outputzdelete DN %slocal_oid:%s:0r    : NFT)	r@   r   r   DSDB_CONTROL_DBCHECKr=   delete	Exceptionrp   r   )r   r   r   r  errs        r#   	do_deletezdbcheck.do_delete  s    <<KK+,	#3d6O6O#O"PPHJJb84   	"""S#9::KKS#./		s   4A 	B 2BBc                    |dt         j                  z  gz   }| j                  rM| j                  | j                  j                  |t        j                               | j                  d|z         	 | j                  j                  |||       y# t        $ r<}| j                  rt        |d|      | j                  |d|       Y d}~yd}~ww xY w)z-perform a modify with optional verbose outputr  zcontrols: %r)r   r   r  NFT)r   r  r@   r   r=   
write_ldifrq   CHANGETYPE_MODIFYmodifyr  rp   r   )r   mr   r  r   r  s         r#   r   zdbcheck.do_modify  s    /$2K2KKLL<<KK

--a1F1FGHKK12	JJa(XF   	"""S#9::KKS#./		s   2B 	C2CCc           
         | j                   r5| j                  dt        |      dt        |      dt        |             	 ||z   }|dt        j                  z  gz   }| j
                  j                  |||       y	# t        $ r<}| j                  rt        |d|      | j                  |d|       Y d}~yd}~ww xY w)
z-perform a rename with optional verbose outputr   z
changeType: modrdn
newrdn: z
deleteOldRdn: 1
newSuperior: r  r   r  NFT)
r@   r   r   r   r  r=   r   r  rp   r   )r   from_dnto_rdnto_baser   r  to_dnr  s           r#   	do_renamezdbcheck.do_rename  s    <<KK 'lCKW	? @
	W$E#3d6O6O#O"PPHJJgux@   	"""S#9::KKS#./		s   :A> >	C2B>>Cc                     || j                   v r| j                   |   S | j                  j                  |      }|r| j                  j                  |      }nd }||f| j                   |<   ||fS N)r   r?   get_linkId_from_lDAPDisplayName!get_backlink_from_lDAPDisplayName)r   attrnamelinkIDrevnames       r#    get_attr_linkID_and_reverse_namez(dbcheck.get_attr_linkID_and_reverse_name  st    t)))%%h//""BB8L''II(SGG(.'88$wr   c                 r   | j                  d|d|       | j                  d|d|dd      s| j                  d|z         yt        j                         }||_        t        j
                  d	t        j                  |      ||<   | j                  |d
dgd|z  d      r| j                  d|z         yy)zfix empty attributeszERROR: Empty attribute  in zRemove empty attribute  from ?rF   zNot fixing empty attribute %sNr/   r   r   z#Failed to remove empty attribute %sFr   zRemoved empty attribute %s)r   r   rq   r   r   r   FLAG_MOD_DELETEr   )r   r   r%  r  s       r#   err_empty_attributezdbcheck.err_empty_attribute  s    2FGRT UWtuKK7(BCKKM((S-@-@(K(>>!i):;?(JUZ  \KK4x?@\r   c                 `   | j                  d|d|       g }|D ]  }| j                  j                  | j                  ||g      }t	        |      dk7  r(| j                  d|z         |j                  |df       a|d   |k7  sj| j                  d|d|d   d	       |j                  ||d   f        | j                  d
|d|dd      s| j                  d|z         yt        j                         }||_	        t        dt	        |            D ]f  }||   \  }}	t        j                  |t        j                  |      |d|z  <   |	dk7  s<t        j                  |	t        j                  |      |d|z  <   h | j                  |ddgd|z  d      r| j                  d|z         yy)z?fix attribute normalisation errors, without altering sort orderz)ERROR: Normalisation error for attribute r*  r5   zUnable to normalise value '%s'r/   r   zvalue 'z' should be ''zFix normalisation for r+  r,  rG   zNot fixing attribute %sNzvalue_%uznormv_%ur   r    Failed to normalise attribute %sFr   Normalised attribute %s)r   r=   dsdb_normalise_attributesr?   r   r   r   rq   r   r   ranger   r-  FLAG_MOD_ADDr   )
r   r   r%  valuesmod_listval
normalisedr  invals
             r#   err_normalise_mismatchzdbcheck.err_normalise_mismatch  s   8UWXY 	6C==!!8cU4J:!#<sBCb	*Q-3&3
1NOjm 45	6 xQS TVmnKK1H<=KKMq#h-( 	AA"1+KS$ # 2 238K8KX VAj1nrz$'$6$6tS=M=M7?%A*q.!		A >>!i):;<xG#(  * KK1H<=*r   c                 "   | j                   j                  | j                  ||      }t        |      |k(  ry| j	                  d|d|d       | j	                  d|dt        |      d       | j                  d|d	|d
d      s| j	                  d|z         yt        j                         }||_        t        j                  |t        j                  |      ||<   | j                  |ddgd|z  d      r| j	                  d|z         yy)z.fix attribute normalisation and/or sort errorsNz*ERROR: Normalisation error for attribute '' in 'r0  z*Values/Order of values do/does not match: /!zFix normalisation for '' from ''?rG   Not fixing attribute '%s'r   r   r1  Fr   r2  )r=   r3  r?   listr   r   rq   r   r   r   r   r   )r   r   r%  r6  r9  r  s         r#   err_normalise_mismatch_replacez&dbcheck.err_normalise_mismatch_replace%  s    ZZ99$:K:KXW]^

v%xY[\]&RVWaRbcd8UW XZqrKK3h>?KKM((S5I5I8T(>>!i):;<xG#(  * KK1H<=*r   c                    | j                  d|d|d       | j                  dt        |      dt        |      d       | j                  d|d|d	d
      s| j                  d|z         yt        j                         }||_        t        j                  |t        j                  |      ||<   | j                  |ddgd|z  d      r| j                  d|z         yy)zfix duplicate attribute valuesz'ERROR: Duplicate values for attribute 'r>  r0  zValues contain a duplicate: [z]/[z]!zFix duplicates for 'rA  rB  rH   rC  Nr   r   z0Failed to remove duplicate value on attribute %sFr   z'Removed duplicate value on attribute %s)	r   r$   r   rq   r   r   r   r   r   )r   r   r%  
dup_valuesr6  r  s         r#   err_duplicate_valueszdbcheck.err_duplicate_values:  s    HVXYZ%j13CF3KM 	NRT UWklKK3h>?KKM((1E1ExP(>>!i):;LxW#(  * KKAHLM*r   c                 B    |j                   dt        j                  z  k(  S )z2see if a dsdb_Dn is the special Deleted Objects DNzB:32:%s:)prefixr   r   )r   r   s     r#   r   zdbcheck.is_deleted_objects_dnL  s    ~~d.T.T!TTTr   c                    | j                  d|d| j                  j                  |      d       | j                  d|z  d      s| j                  d|z         y| j	                  |dgd	|z        r| j                  d
|z         yy)z!handle object without objectclassz%ERROR: missing objectclass in object zw.  If you have another working DC, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> r0  zIIf you cannot re-sync from another DC, do you wish to delete object '%s'?r~   z1Not deleting object with missing objectclass '%s'Nr   Failed to remove DN %sRemoved DN %s)r   r=   get_nc_rootr   r  r   r   s     r#   err_missing_objectclasszdbcheck.err_missing_objectclassP  s      |~  @D  @J  @J  @V  @V  WY  @Z  [  	\ knp p  sP  QKKKbPQ>>"yk2R79KK",-9r   c                 v   |s[| j                  d|d|d|       | j                  dt        |      z         | j                  dd      sm| j                  d       y| j                  d	|d|d|       | j                  dt        |      z         | j                  d
d      s| j                  d       yt        j                         }||_        t        j                  |t        j                  |      |d<   | j                  |ddt        j                  z  gd|z        r| j                  d|z         yy)z(handle a DN pointing to a deleted objectz ERROR: target DN is deleted for  in object  - z#Target GUID points at deleted DN %rzRemove DN link?rK   zNot removingNz"WARNING: target DN is deleted for zRemove stale DN link?rL   	old_valuer   r  z(Failed to remove deleted DN attribute %sz"Removed deleted DN on attribute %s)r   r   r   rq   r   r   r   r-  r   r    DSDB_CONTROL_REPLMD_VANISH_LINKS)r   r   r%  r8  r   
correct_dnremove_plausibler  s           r#   err_deleted_dnzdbcheck.err_deleted_dnZ  s   KKRZ\^`cdeKK=JOP##$57\]N+KKT\^`befgKK=JOP##$;=`aN+KKM++C1D1DhO+>>!/.1V1VVXDxOQ KK<xGHQr   c           
      8   t        |      j                  d      dk7  r,| j                  d|d|d|       | j                  d       y| j                  |      \  }}|dz  dk(  r>t        |      j                  d      dk(  r | j                  |      \  }}|,| j                  d
|d|d|       | j                  d       y| j                  j                  |      }	 | j                  j                  |j                        }	|	9| j                  d|d|j                  d|d|       | j                  d       y||	k7  r,| j                  d|d|d|       | j                  d       y| j                  d|d|d|       | j                  |||||d       y| j                  d|d|d|       | j                  |||||d       y# t        j                  $ r0}
|
j                  \  }}|t        j                  k7  r d	}	Y d	}
~
d	}
~
ww xY w)zxhandle a missing target DN (if specified, GUID form can't be found,
        and otherwise DN string form can't be found)z\0ADELz8WARNING: no target object found for GUID component link z in deleted object rS  z`Not removing dangling one-way link on deleted object (tombstone garbage collection in progress?)r   r5   NzLWARNING: no target object found for GUID component for one-way forward link rR  z"Not removing dangling forward linkz<WARNING: no target object found for GUID component for link z in object to z outside our NCszhNot removing dangling one-way left-over link outside our NCs (we might be building a renamed/lab domain)zLWARNING: no target object found for GUID component for cross-partition link zPNot removing dangling one-way cross-partition link (we might be mid-replication)z@WARNING: no target object found for GUID component for DN value Tz:ERROR: no target object found for GUID component for link F)r   findr   r(  r=   rN  r   rq   r   r   r   rX  )r   r   r%  r8  r   r&  _reverse_link_namenc_roottarget_nc_rooter   r   s                r#   err_missing_target_dn_or_GUIDz%dbcheck.err_missing_target_dn_or_GUIDq  s.   
 r7<<	"b( KK%-r38 9 KK F G  99(C	QJ!OW!2!29!=!C 77A &F% , *22s< = @Ajj,,R0G&!%!7!7

!C %  *27::r3H I  J K .(  *22s< =  < =  KK%-r38 9 Hc '$8 	!)2s4 	5 	B#wGe << & vvt3111!%	&s   #%G H)%HHc           
         | j                  d|d|d|d|       ddg}	 | j                  j                  t        |j                        t
        j                  g |      }t        |      dk(  r3| j                  d|j                  z         | j                  ||||       y|d   j                  |_        | j                  dt        |      z  d      s| j                  d|z         yt        j                         }||_        t        j                  |t
        j                  |      |d<   t        j                  t        |      t
        j                   |      |d<   | j#                  |dgd|d|      r| j                  d|d|       yy# t
        j                  $ rc}|j                  \  }	}
| j                  d|j                  d	|
d
       |	t
        j                  k7  r | j                  ||||       Y d}~yd}~ww xY w)z+handle a missing GUID extended DN componentERROR:  component for rR  rS  r   r   r   zunable to find object for DN z - ()Nr   zunable to find object for DN %sChange DN to %s?rI   Not fixing %srT  	new_valueFailed to fix  on attribute Fixed )r   r=   r   r   r   rq   r   r   r   r   ra  r   r   r   r   r-  r5  r   )r   r   r%  r8  r   errstrr   r   e7r   r   r  s               r#   err_missing_dn_GUID_componentz%dbcheck.err_missing_dn_GUID_component  s   fhXZ\_`a%'89		**##WZZ*,x $ AC s8q=KK9GJJFG..r8S'JVYY
 2S\ ACUVKK&01KKM++C1D1DhO+++CL#:J:JHU+>>!/0@FQSKKfhGHS+ || 	77LT4KKGJJPTUVs---..r8S'J	s   A F H%AHHc           
         | j                  d|d|d|d|       | j                  dt        |      z  d      s| j                  d|z         yt        j                         }||_        t        j                  |t        j                  |      |d	<   t        j                  t        |      t        j                  |      |d
<   | j                  |dgd|d|      r| j                  d|d|       yy)z'handle an incorrect binary DN componentrc  z binary component for rR  rS  rf  rJ   rg  NrT  rh  r   ri  rj  rk  )
r   r   r   rq   r   r   r   r-  r5  r   )r   r   r%  r8  r   rl  r  s          r#   err_incorrect_binary_dnzdbcheck.err_incorrect_binary_dn  s    VU]_acfgh 2S\ ACVWKK&01KKM++C1D1DhO+++CL#:J:JHU+>>!/0@FQSKKfhGHSr   c                 
   | j                  d|d|d|       ||_        | j                  dt        |      z  d      s| j                  d       yt	        j
                         }||_        t	        j                  |t        j                  |      |d<   t	        j                  t        |      t        j                  |      |d	<   | j                  |d
dt        j                  z  gd|z        r| j                  d|z         yy)z<handle a DN string being incorrect due to a rename or deletez<NOTE: old (due to rename or delete) DN string component for rR  rS  rf  rQ   zNot fixing old string componentNrT  rh  r   local_oid:%s:1z+Failed to fix old DN string on attribute %sz#Fixed old DN string on attribute %s)r   r   r   r   rq   r   r   r-  r5  r   r   %DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME)r   r   r%  r8  r   rV  r  s          r#   err_dn_string_component_oldz#dbcheck.err_dn_string_component_old  s    jrtvx{|}
 2S\ A JLKK9:KKM++C1D1DhO+++CL#:J:JHU+>>!/.1[1[[]G8TV KK=JKVr   c           
         | j                  d|d|d|d|       ||_        | j                  dt        |      z  d|z        s| j                  d|z         yt	        j
                         }||_        t	        j                  |t        j                  |      |d	<   t	        j                  t        |      t        j                  |      |d
<   | j                  |dgd|d|      r| j                  d|d|       yy)z"handle a DN string being incorrectzERROR: incorrect DN rd  rR  rS  rf  z fix_all_%s_dn_component_mismatchz Not fixing %s component mismatchNrT  rh  r   zFailed to fix incorrect DN rj  zFixed incorrect DN )
r   r   r   r   rq   r   r   r-  r5  r   )r   r   r%  r8  r   rV  mismatch_typer  s           r#    err_dn_component_target_mismatchz(dbcheck.err_dn_component_target_mismatch  s    S`bjlnpstu
 2S\ A B] RTKK:]JKKKM++C1D1DhO+++CL#:J:JHU+>>!/0MZ\degKK=RZ[\gr   c                 V   | j                  d|d|d|       t        |j                        dk7  r| j                  d       yt        j                  | j
                  |j                  j                               }|j                  d|       | j                  d|j                         z  d	      s| j                  d
       y|j                  d      }t        j                  | j
                  d      }|j                  d|       |j                  d|       t        j                         }	||	_        t        j                  |j                         t        j                  |      |	d<   ddt        j                  z  g}
| j!                  |	|
d|z        r| j                  d|z         yy)z*fix missing <SID=...> on linked attributesz$ERROR: missing DN SID component for rR  rS  r   z3Not fixing missing DN SID on DN+BINARY or DN+STRINGNSIDrf  rP   z#Not fixing missing DN SID componentr   r/   rh  r   rr  z,Failed to ADD missing DN SID on attribute %sz$Fixed missing DN SID on attribute %s)r   r   rJ  rq   rr   r=   r   extended_strset_extended_componentr   r   r   r   r5  r   $DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SIDr   )r   r   r%  r8  r   target_sid_blobrV  target_guid_blobguid_sid_dnr  r   s              r#   #err_dn_component_missing_target_sidz+dbcheck.err_dn_component_missing_target_sid  sh   RZ\^`cdew~~!#KKMNVVDJJ

(?(?(AB
))%A 2Z5L5L5N N BDKK=>%<<VDffTZZ,**63CD**5/BKKM++K,D,D,FHXHXZbc+tHHH
 >>!XHHUWKK>(KLWr   c                    | j                  d|d|j                         | j                  d|z  d      s| j                  d|z         yt        j                         }|j                  |_        t        j
                  g t        j                  |      |d<   | j                  |dd	gd
|z        r| j                  d|z         yy)z!handle an unknown attribute errorzERROR: unknown attribute '' in zRemove unknown attribute %srE   zNot removing %sNrT  r   r   z%Failed to remove unknown attribute %szRemoved unknown attribute %s)r   r   r   rq   r   r   r-  r   )r   objr%  r  s       r#   err_unknown_attributezdbcheck.err_unknown_attribute9  s    XsvvNO = HJijKK)H45KKMvv++B0C0CXN+>>!i):;AHLNKK6(CDNr   c                    | j                  d|d|d|j                         | j                  d|z  d      s| j                  d|z         yt        j                         }|j                  |_        t        j
                  |t        j                  |      |d<   | j                  |d	d
ddt        j                  z  gd|z        r| j                  d|z         yy)z:handle a link that should not be there on a deleted objectzERROR: linked attribute 'z' to 'z' is present on deleted object zRemove linked attribute %srT   z Not removing linked attribute %sNrT  r   r   r   r  z Failed to delete forward link %szFixed undead forward link %s)
r   r   r   rq   r   r   r-  r   r   rU  )r   r  r%  r8  r  s        r#   err_undead_linked_attributez#dbcheck.err_undead_linked_attributeF  s    +3S#&&B 	C <x GIghKK:XEFKKMvv++C1D1DhO+>>!/1ACW.1V1VVX<xGI KK6(CDIr   c           
         | j                  d|d|d|d|j                         | j                  d|z  d      s| j                  d|z         yt        j                         }||_        t        j
                  |t        j                  |      |d	<   | j                  |d
dgd|z        r| j                  d|z         yy)zhandle a missing backlink valuez#ERROR: missing backlink attribute 'r  
 for link r*  zFix missing backlink %srU   zNot fixing missing backlink %sNrh  r   r   z!Failed to fix missing backlink %szFixed missing backlink %s)r   r   r   rq   r   r   r5  r   )r   r  r%  r8  backlink_name	target_dnr  s          r#   err_missing_backlinkzdbcheck.err_missing_backlinkV  s    Xegprz|  }C  }C  D  	E 9M IKfgKK8=HIKKM++C1A1A=Q+>>!/;=MOKK3}EFOr   c                    t        |j                  j                  d            }| j                  d|||j                  |j                  j	                         fz         | j                  d|z  d      s| j                  d|z         yt        j                         }|j                  |_        t        j                  t        |      t        j                  |      |d<   | j                  |g dd	|z        r| j                  d
|z         yy)z"handle a incorrect RMD_FLAGS value	RMD_FLAGSzHERROR: incorrect RMD_FLAGS value %u for attribute '%s' in %s for link %szFix incorrect RMD_FLAGS %ur[   z!Not fixing incorrect RMD_FLAGS %uNrT  )r   r   show_deleted:0z$Failed to fix incorrect RMD_FLAGS %uzFixed incorrect RMD_FLAGS %u)r   r   r   r   rz  r   rq   r   r   r   r-  r   )r   r  r%  revealed_dn	rmd_flagsr  s         r#   err_incorrect_rmd_flagszdbcheck.err_incorrect_rmd_flagsc  s   ==kJK	^bkmuwzw}w}  @K  @N  @N  @[  @[  @]  b^  ^  	_ <y H/ZKK;iGHKKMvv++C,<c>Q>QS[\+>>!X@9LNKK6)DENr   c                    |du r5| j                  |||      r"| j                  dd|d|d|d|d	z          y| j                  d|d|d	|d
|       | j                  d|z  d      s| j                  d|z         yt        j                         }||_        t        j                  |t        j                  |      |d<   | j                  |ddgd|z        r| j                  d|z         yy)z handle a orphaned backlink valueTz*WARNING: Keep orphaned backlink attribute r0  r>  z' for link 'Nz$ERROR: orphaned backlink attribute 'r  r  r*  zRemove orphaned backlink %srV   z!Not removing orphaned backlink %sr"   r   r   z"Failed to fix orphaned backlink %szFixed orphaned backlink %s)	has_duplicate_linksr   r   rq   r   r   r   r-  r   )	r   obj_dnbacklink_attrbacklink_valr  forward_attrforward_syntaxcheck_duplicatesr  s	            r#   err_orphaned_backlinkzdbcheck.err_orphaned_backlinkq  s     t#(@(@LZh(iKKD)6<LL M Yfhnp|  H  I  	J = MOklKK;mKLKKM''c6I6I=Y'
>>!/;>NPKK4FGPr   c                 >   | j                  d|d|j                  d       | j                  d|z  d      s#| j                  d|d|j                  d       yt        j                         }|j                  |_        t        j
                  |t        j                  |      |d	<   | j                  |d
t        j                  z  gd|z        rN| j                  d|z         t        |j                        d|}|| j                  v sJ d| j                  |<   yy)zhandle a duplicate links valuezERECHECK: 'Missing/Duplicate/Correct link' lines above for attribute 'r>  r0  zDCommit fixes for (missing/duplicate) forward links in attribute '%s'rZ   zENot fixing corrupted (missing/duplicate) forward links in attribute '' of 'Nr"   rr  z/Failed to fix duplicate links in attribute '%s'z'Fixed duplicate links in attribute '%s'r   F)r   r   r   rq   r   r   r   r   r   (DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKSr   rY   )r   r  r  forward_valsr  duplicate_cache_keys         r#   err_recover_forward_linksz!dbcheck.err_recover_forward_links  s    	jvx{x~x~  	A fiu u  xS  TKK$cff. /KKMvv''c6J6JLY'
>>!.1^1^^_KlZ\KKA\RS-0[,"G&$*C*CCCC=BD%%&9:\r   c                    | j                  d|j                  z         | j                  j                  dt        j
                  dg      }t        |      dk(  sJ t        |d   d   d         }| j                  d|j                  d|d	      s"| j                  d
|j                  d|       yt	        j                         }|j                  |_        t	        j                  |t        j                  d      |d<   | j                  |g d|j                  d|      r"| j                  d|j                  d|       yy)zhandle a missing fSMORoleOwnerz*ERROR: fSMORoleOwner not found for role %sr/   dsServiceName)r+   r,   r5   r   zSeize role z) onto current DC by adding fSMORoleOwner=r^   zNot Seizing role NfSMORoleOwnerr"   zFailed to seize role zSeized role )r   r   r=   r   rq   r   r   r   r   r   r   r5  r   )r   r  r   serviceNamer  s        r#   err_no_fsmoRoleOwnerzdbcheck.err_no_fsmoRoleOwner  s   @CFFKLjj&)nn_<M   O3x1}}#a&1!45^a^d^dfq r  uF  GKK\_\b\bdopqKKMvv''S5E5EW'
>>!RbebhbhjuvxKKWZW]W]_jklxr   c                    | j                  d|j                  z         | j                  d|j                  z  d      s| j                  d|j                  z         yd}| j                  j	                          	 | j                  j                  |j                        }| j                  j                  |t        j                        }t        j                  | j                  t        |j                              }|j                  t        |      dz
         | j                  |j                  ||dd	gd
|j                  d||z         r| j                  d|j                  d||z          t        j                         }|j                  |_        t        j                   t        |j                  j#                               t        j$                  d      |d<   | j'                  |g d||z   z        r| j                  d||z   z         d}|r| j                  j+                          y| j                  j)                          y#  | j                  j)                           xY w)zhandle a missing parentz%ERROR: parent object not found for %sz!Move object %s into LostAndFound?r_   z&Not moving object %s into LostAndFoundNFr5   r  r   Failed to rename object z into lostAndFound at zRenamed object lastKnownParentz:Failed to set lastKnownParent on lostAndFound object at %sz0Set lastKnownParent on lostAndFound object at %sT)r   r   r   r=   transaction_startrN  r   r   DS_GUID_LOSTANDFOUND_CONTAINERrq   rr   r   remove_base_componentsr   r   r   r   parentr   r   transaction_canceltransaction_commit)r   r  keep_transactionr^  lost_and_foundnew_dnr  s          r#   err_missing_parentzdbcheck.err_missing_parent  s   ;svvFG Csvv NPhiKK@CFFKL 

$$&	jj,,SVV4G!ZZ88$BeBefNVVDJJCFF4F))#f+/:~~cfffn?OQZ>[VYV\V\^dgu^uvx366SY\jSjklKKMvv'*'9'9#cffmmo:NPSPdPdfw'x#$>>!R"^bhkyby"z|KK RV\_mVm no'+$
 JJ))+JJ))+	JJ))+s   :FI	 	I&c           
      Z   t        j                  | j                  t        |            }|j	                  t        |      dz
         |j                         }d}	||k7  r|	|d|dz  }	|	d|z  z  }	| j                  d|j                  d|	d|d	       | j                  d
|j                  d|dd      s"| j                  d|j                  d|       y| j                  |j                  |||d|j                  d|      r"| j                  d|j                  d|       yy)zhandle a wrong dnr5   r/   = zname=%rzERROR: wrong dn[z] z new_dn[]zRename r   r,  rf   zNot renaming Nr  z into zRenamed )rq   rr   r=   r   r  r   r  r   r   r   r   )
r   r  r  rdn_attrrdn_valname_valr   new_rdn
new_parent
attributess
             r#   err_wrong_dnzdbcheck.err_wrong_dn  s     &&S[1&&s7|a'78]]_

hh88Ji8,,
366:vVWcfff ExPKK3666BC>>#&&':xBE&&&QSKK?@Sr   c                 6   | j                  d|d   |j                  |fz         | j                  d|d   ||j                  fz  d      s%| j                  d|d   ||j                  fz         yt        j                         }|j                  |_        t        j
                  t        |      t        j                  d      |d<   | j                  |dt        j                  z  gd	|j                  |fz        r!| j                  d
|j                  |fz         yy)zhandle a wrong instanceTypez0ERROR: wrong instanceType %s on %s, should be %dinstanceTypez(Change instanceType from %s to %d on %s?r`   z-Not changing instanceType from %s to %d on %sNr"   r  zGFailed to correct missing instanceType on %s by setting instanceType=%dz7Corrected instancetype on %s by setting instanceType=%d)r   r   r   rq   r   r   r   r   r   r   &DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)r   r  calculated_instancetyper  s       r#   err_wrong_instancetypezdbcheck.err_wrong_instancetype  s@   F#nJ]_b_e_eg~I  	A JcR`Nacz|  }C  }C  ND  !D  FX  YKKG3~K^`wy|yy  KA  A  BKKMvv'',C(DcFZFZ\jk'
>>!.1\1\\]cgjgmgm  pG  gH  HIKKQUXU[U[]tTuuvIr   c                     | j                  d|j                  d| j                  j                  |j                        d       y )N0ERROR: incorrect userParameters value on object z.  If you have another working DC that does not give this warning, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> r0  r   r   r=   rN  )r   r  r%  r"   s       r#   err_short_userParametersz dbcheck.err_short_userParameters  si      gj  gm  gm  os  oy  oy  oE  oE  FI  FL  FL  oM  N  	Or   c                    | j                  d|d|j                  d       | j                  d|j                  z  d      s| j                  d|j                  z         yt        j                         }|j                  |_        t        j
                  t        ||   d         t        j                  d	      |d
<   | j                  |g d|j                  z        r| j                  d|j                  z         yy)z6handle a userParameters that is wrongly base64 encodedz(ERROR: wrongly formatted userParameters  on z, should not be base64-encodedz2Convert userParameters from base64 encoding on %s?rg   z6Not changing userParameters from base64 encoding on %sNr   userParametersr"   zOFailed to correct base64-encoded userParameters on %s by converting from base64zGCorrected base64-encoded userParameters on %s by converting from base64)	r   r   r   rq   r   r   r   r   r   r   r  r%  r"   r  s        r#   err_base64_userParametersz!dbcheck.err_base64_userParameters  s    hmorououvw TX[X^X^ _a|}KKPTWTZTZ[\KKMvv''	#h-2B(CSEYEY[kl'
>>!RkorououvxKKaehekeklmxr   c                    | j                  d|j                  z         | j                  d|j                  z  d      s| j                  d|j                  z         yt        j                         }|j                  |_        t        j
                  ||   d   j                  d      j                  d      t        j                  d	      |d
<   | j                  |g d|j                  z        r| j                  d|j                  z         yy)z5handle a userParameters that is wrongly utf-8 encodedzPERROR: wrongly formatted userParameters on %s, should not be pseudo-UTF8 encodedz0Convert userParameters from UTF8 encoding on %s?rh   z4Not changing userParameters from UTF8 encoding on %sNr   r1   	utf-16-ler  r"   zQFailed to correct psudo-UTF8 encoded userParameters on %s by converting from UTF8zICorrected psudo-UTF8 encoded userParameters on %s by converting from UTF8
r   r   r   rq   r   r   r   encoder   r   r  s        r#   err_utf8_userParameterszdbcheck.err_utf8_userParameters  s     8;>66C 	D RVYV\V\ ]_xyKKNRURXRXYZKKMvv''Ha(8(?(?(G(N(N{([(+(<(<>NP'
>>!RmqtqwqwxzKKcgjgmgmnozr   c                    | j                  d|j                  z         | j                  d|j                  z  d      s| j                  d|j                  z         yt        j                         }|j                  |_        t        j
                  ||   d   j                  d      j                  d      t        j                  d	      |d
<   | j                  |g d|j                  z        r| j                  d|j                  z         yy)z:handle a userParameters that has been utf-16 encoded twicezQERROR: wrongly formatted userParameters on %s, should not be double UTF16 encodedz:Convert userParameters from doubled UTF-16 encoding on %s?ri   z>Not changing userParameters from doubled UTF-16 encoding on %sNr   r  r1   r  r"   zJFailed to correct doubled-UTF16 encoded userParameters on %s by convertingzBCorrected doubled-UTF16 encoded userParameters on %s by convertingr  r  s        r#   err_doubled_userParametersz"dbcheck.err_doubled_userParameters  s    gknkqkqrs \`c`f`f g  jF  GKKX\_\b\bcdKKMvv ''Ha(8(?(?(L(S(STZ([(+(<(<>NP'
 >>!RfjmjpjpqsKK\`c`f`fghsr   c                     | j                  d|j                  d| j                  j                  |j                        d       y)z?Fix a truncated userParameters due to a pre 4.1 replication bugr  z (odd length).  If you have another working DC that does not give this warning, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> r0  Nr  )r   r  r%  s      r#   err_odd_userParameterszdbcheck.err_odd_userParameters+  si      tw  tz  tz  |@  |F  |F  |R  |R  SV  SY  SY  |Z  [  	\r   c                 H   | j                   j                  |t        j                  |gg d      }| j                  j                  |      }|d   |   D ]L  }t        | j                   |j                  d      |      }|j                  j                  d      }||k(  sJ|c S  y)z#return a revealed link in an object)r  r   r   r   r   r1   r   N)
r=   r   rq   r   r?   #get_syntax_oid_from_lDAPDisplayNamer   r   r   r   )	r   r   r%  r   r   
syntax_oidr8  r   guid2s	            r#   find_revealed_linkzdbcheck.find_revealed_link/  s    jjRs~~hZ)b   d&&JJ8T
q6(# 	Cdjj#**V*<jIGJJ55f=Eu}		
 r   c                    d}t               }t               }|dz  r|||fS ||||fS t        |j                        d|}	|	| j                  vrd| j                  |	<   ||   D ]  }
t	        | j
                  |
j                  d      |      }|j                  j                  d      }|Ht        t        j                  |            }||j                  z   }||vr|||<   |dz  }||vr%t               ||<   d||   d<   t               ||   d	<   t        ||   j                  j                  d
            }t        |j                  j                  d
            }||kD  r$||   ||   d<   ||   d	   j                  |       !||k  r)|||   d<   ||   d	   j                  ||          |||<   Ot        ||   j                  j                  d            }t        |j                  j                  d            }||k\  r$||   ||   d<   ||   d	   j                  |       |||   d<   ||   d	   j                  ||          |||<    |dk7  rd| j                  |	<   |||fS )1check a linked values for duplicate forward linksr   r5   Nr   Fr1   r   keepr  RMD_VERSIONRMD_LOCAL_USNT)rX   r   r   rY   r   r=   r   r   r   r   rJ  rD  r   r   )r   r  r  r  forward_linkIDr  r   duplicate_dictunique_dictr  r8  r   r   guidstrkeystrv1v2u1u2s                      r#   check_duplicate_linkszdbcheck.check_duplicate_links;  s   f A== ==),SVVlCd&?&??=BD%%&9:|$ '	*Cdjj#**V*<nMG ::44V<D|$))D/*Gw~~-F[(&-F#1K^+)-v&15v&v.376v&x0 [(++BB=QRBWZZ66}EFBBw1<V1Dv&v.v&x077@Bw18v&v.v&x077F8KL&-F#[(++BB?STBWZZ66GHBRx1<V1Dv&v.v&x077@-4N6"6*6"8,33K4GH")KO'	*R !=AD%%&9:^[99r   c                    d}t        |      d|}|| j                  v r| j                  |   S | j                  |      \  }}|g}ddg}		 | j                  j	                  t        |      t
        j                  ||	      }
|
d   }| j                  |||||      \  }}}|| j                  v r| j                  |   S y# t
        j                  $ r-}|j                  \  }}|t
        j                  k7  r Y d}~yd}~ww xY w)r  r   r   r   r   r   NF)r   rY   r(  r=   r   rq   r   r   r   r   r  )r   r   r  r  r   r  r  r  r,   r   r   e8r   r   r  r  r  s                    r#   r  zdbcheck.has_duplicate_links|  s   ),R,?$";";;,,-@AA(,(M(Ml([%%';<	**##R*/( $ DC !f&&sL..Zgh 	1^[ $";";;,,-@AA || 	77LT4s---	s   6B> >C>#C99C>c                 &   g }d}|||fS |t         j                  k7  r| j                  d|z         ||fS d| j                  v r| j                  d       ||fS 	 |d   d   }t	        t        t        j                  |            }	d|d|	d	}
| j                  j                  |
t         j                  dgg d
      }|D ]   }t        | j                  |j                  j                         |      }|j                  j!                  d      }t	        t        j                  |            }||v rqt        t"        j$                  |d   d         }|j&                  j(                  D ]9  }|j*                  }|j,                  }|j.                  t0        j2                  k(  s9 n t        j                  d      }d}}|}d}|}|}}d}|j                  j5                  dt	        |             |j                  j5                  dt	        |             |j                  j5                  dt	        |             |j                  j5                  dt7        |             |j                  j5                  dt	        |             |j                  j5                  dt	        |             |j                  j5                  dt	        |             |dz  }|j9                  |       # ||fS # t         j                  $ r}|j                  \  }} d}~ww xY w)zMFind all backlinks linking to obj_guid_str not already in forward_unique_dictr   Nz5Not checking for missing forward links for syntax: %ssortedLinkszQNot checking for missing forward links because the db has the sortedLinks feature
objectGUID(z=<GUID=z>))r   search_options:1:2zpaged_results:1:1000)r4   r+   r,   r   r   replPropertyMetadataz$ffffffff-4700-4700-4700-000000b13228r5   RMD_ADDTIMERMD_CHANGETIMEr  RMD_INVOCIDRMD_ORIGINATING_USNr  r  )rq   	SYNTAX_DNr   r;   r   r	   r   r   r=   r   SCOPE_SUBTREEr   r   r   r   rz  r   r   replPropertyMetaDataBlobctrarray	local_usnoriginating_change_timeattidr   DRSUAPI_ATTID_objectClassr{  r
   r   ) r   r  r  r  r  forward_unique_dictmissing_forward_linksr   obj_guidobj_guid_strfilterr   e9r   r   rr  r   r  replr   r  toriginating_invocidoriginating_usnrmd_addtimermd_changetimer  rmd_invocidrmd_originating_usnrmd_local_usnrmd_versions                                    r#   )find_missing_forward_links_from_backlinksz1dbcheck.find_missing_forward_links_from_backlinks  s    !# );77S]]*KKO&' ();77D333KK 6 7);77	<(+Hz$))X>?L)6EF**##v*-*;*;L>.F $ GC  >	4A

ADD,=,=,?PI<<66v>D$))D/*G--( h??!"89!<>DXX^^ KK	--77g???	 #')),R"SOKNI-K"1%MKLL//s;?OPLL//0@#nBUVLL//S^LLL//x?TULL//0EsK^G_`LL//]ASTLL//s;?OP1K!((3}>	4@ &{33I || 	77LT4	s   A$K( (L;LLc                    d}|d   d   }| j                  |      \  }}|| j                  j                  |      }nd}|dv }	|	r| j                  ri }
n| j	                  |||||      \  }}
}t        |
      dk7  r| j                  ||||      \  }}||z  }|j                         D cg c]  }| }}|dk7  r#| j                  d|d|j                  d       n"| j                  d|d|j                  d       |D ]v  }| j                  d	|z         | j                  d
|z  d      sE| j                  |j                  ||j                  j                         |j                  ||d       q||gz  }x |
j                         D ]<  }|
|   }|d   D ]  }| j                  d|z          | j                  d|d   z         > t        |      D cg c]  }t        |       }}| j!                  |||       t#        j$                  |d|      ||<   ||   D ]  }t'        | j(                  |j+                  d      |      }|j                  j-                  d      }|%|dz  }| j/                  |j                  |||d       lt        t1        j2                  |            }ddg}t        |      j5                         dk(  r-|j                  | j6                  k(  rd}|j9                  d       nd}||j9                  |       	 | j(                  j;                  d|z  t"        j<                  |g d      }|rudtG        |d   d   d         z  |_$        dtG        |d   d   d         z  |_%        t        |      t        |      k7  r&|dz  }| jM                  |j                  |||d        d|v xr" t        |d   d         jO                         d!k(  }d|d   v xr% t        |d   d   d         jO                         d!k(  } |r4|j                  | jP                  vr|r| jS                  |||       |dz  }"| r| jU                  |      s|r|dz  }|j                  j-                  d"      }!|!rd|d   v rtW        tX        jZ                  |d   d#   d         }"d}#|"j\                  j^                  D ]>  }$|$j`                  tb        jd                  k(  s!|$jf                  }%|%tG        |!      k\  s<d}# n |#r/| ji                  |j                  ||||d   j                  d       | ji                  |j                  ||||d   j                  d       ?|j                  j-                  d$      }&d}'|&tG        |&      }'|'dz  sd|bt        |d   j                        t        |j                        k7  r4|dz  }| jk                  |j                  ||||d   j                  d%       |d   j                  j-                  d      |j                  j-                  d      k7  r4|dz  }| jk                  |j                  ||||d   j                  d       @|d   j                  j-                  d&      }(|j                  j-                  d&      })|)(|(&|dz  }| jm                  |j                  ||||(       |)|(k7  r4|dz  }| jk                  |j                  ||||d   j                  d&       ||dk(  rt        |d   j                        t        |j                        k7  rS|jH                  |j                  jo                         z   }*| jq                  |j                  ||*||d   j                         f|	r| j                  rvd}+||d   v r|d   |   D ]}  },t'        | j(                  |,j+                  d            }-|-j                  j-                  d      }.|-j                  j-                  d$      }/d}0|/tG        |/      }0|0dz  rs|.|k(  sy|+dz  }+ |+dk7  r|tr        jt                  k(  s|tr        jt                  k(  ra|dz  s\d}1||   D ]K  }2t'        | j(                  |2j+                  d            j                  j-                  d      }3|3|k(  sG|1dz  }1M |+|1k(  rd}4||   D ]}  },t'        | j(                  |,j+                  d            }-|-j                  j-                  d      }.|-j                  j-                  d$      }/d}0|/tG        |/      }0|0dz  rs|.|k(  sy|4dz  }4 |+|4k(  r!|4|+z
  }5|dz  rx|+dk(  r1|dz  }| j                  |j                  |||j                  ||       a| j                  d'||4t        |j                        ||+t        |j                        fz         | rJ | j                  d(||4t        |j                        ||+t        |j                        fz         |5dk7  s|dz  }|5dkD  rp|+dkD  s|5dkD  r)| j                  d)t        |j                        z         +| jw                  |||j                  j                         ||j                         |5dz  }5nJ| j                  |d   j                  ||j                  j                         |j                  ||       |5dz  }5|5dk7  rʐ |S c c}w c c}w # t"        j>                  $ rO}|j@                  \  }}|t"        jB                  k7  r || jE                  |j                  |||      z  }Y d}~	$d}~ww xY w)*z$check a DN attribute for correctnessr   r  N)membermemberOfz@ERROR: Missing and duplicate forward link values for attribute 'r>  r0  z4ERROR: Duplicate forward link values for attribute 'zMissing   link '%s'z8Schedule re-adding missing forward link for attribute %srW   F)r  r  zDuplicate link '%s'zCorrect   link '%s'r  r1   r   r5   zmissing GUID	isDeletedreplPropertyMetaDatazmsds-hasinstantiatedncsTr  	<GUID=%s>)r   r   r   r   z	B:8:%08X:z%08Xz(incorrect instanceType part of Binary DNTRUEr  r  r  stringry  zHWARNING: Link (back) mismatch for '%s' (%d) on '%s' to '%s' (%d) on '%s'zIERROR: Link (forward) mismatch for '%s' (%d) on '%s' to '%s' (%d) on '%s'z5ERROR: Can't fix missing multi-valued backlinks on %s)<r(  r?   r  rk   r  r   r  r6  r   r   r   r  rz  keyssortedr   r  rq   r   r   r=   r   r   rn  r   r   lowerr{   r   r   r   r   r   r   ra  r   rJ  binaryrp  upperr   r  r   r	   r   r  r  r  r  r   DRSUAPI_ATTID_isDeletedr  rX  rw  r  r   rt  r   r   r  )6r   r  r%  r  r   r   r&  r]  reverse_syntax_oidis_member_linkr  r  r  missing_error_countr   forward_linksr  r  dddr    r8  r   r   r  r,   fixing_msDS_HasInstantiatedNCsr   e3r   r   
is_deletedtarget_is_deletedr  r  
found_datar   deleted_usnrmd_blobr  
target_sidlink_sidbad_dnmatch_countvv_dnv_guidv_blobv_rmd_flagsforward_countww_guidexpected_count
diff_counts6                                                         r#   check_dnzdbcheck.check_dn  s   |$Q'$($I$I($S!!(!%!2!2!V!VWh!i!%!%;;d::N **3*+13DF 5K ~!# >>s?G?P?JL 7!#6
 ..K*5*<*<*>?BR?M?"a'$cff. / aiknkqkqrs* 	%1Q78''(bem(m(GI..qtt5F/2vv/B/B/Dcff/7@E / G !$	% )--/ ?"6*H+ <BKK 5 :;<1AfI=>	? '-]&;<CG<D<**3$?..tQACMx= k	$Cdjj#**V*<jIG ::44V<D|q 223668S'3AC$))D/*G "89EH##%)BBSWS`S`I`15.^,16. ,./jj''[7-B#...3 ?A ( B  .!,s3q6.3I!3L/M!M!'#c!f^.DQ.G*H!Hw<3s8+1$K003Q{| %+ZC4DQ4G0H0N0N0PTZ0ZJ +s1v 5 g#c!f[>QRS>T:U:[:[:]ag:gcffD,K,KKPV
 00hDq "4+E+Eg+NSY q #JJ==oN	-Q7)(*K*K*-a&1G*H*K M%*
!% *A ww'*I*II./kk#.#i.#@ 26J$)* & //03Wc!fiiO$##CFFHc7CFIIuU
 zz88EHI#M	 q=%6%Bs1vyy>S_41$K99#&&(CQX:=a&))XO1vyy//77::;\;\]c;ddq 55cffhW69!fiiIQ99%@Jzz88?HJ$:q 8839@*N:%q 55cffhW69!fiiH !(Q;3s1vyy>S_#D
 %^^gjj.G.G.IIF44SVVXv5<c!fiiI$">"> K CF*Q 12 
)A"4::qxx/?@D!WW;;FCF!WW;;KHF"#K)&)&k"Q )#q(
) a!;!;;?QUYUoUo?o!A:()!$X 3A%,TZZ&9I%J%M%M%d%dek%lF%~ - 23
 '-7$N] 
(tzz188F+;<77?77D%"%f+K?T>"a'N
( n,'+5Jz !#1$K..svvx/2GJJ/@/AC f$nc#&&k-{C

OjM M N (((KKc .#cff+);GJJgI I J /q >"Q*q. %CEH_%U V--c8.1ff.A.A.C.?.5jj: !OJ..s1vyy:K/2vv/B/B/Dcff/7E !OJ# /uk	$Z Y @4 =D << 
!wwt3111 tAA#&&BJBEBI K K 
s%   +	kk
2k$$m7Ammc                 `    |j                   j                  D ]  }|j                  |k(  s|c S  y r"  )r  r  r  )r   r  r  r   s       r#   find_repl_attidzdbcheck.find_repl_attid-  s/     	Aww%	 r   c                 x    t        t        j                  |      }| j                  ||      }||j                  S y)zRead metadata properties and return the originating time for
           a given attributeId.

           :return: the originating time or 0 if not found
        r   )r	   r   r  r;  r  )r   r8  r  r  r   s        r#   get_originating_timezdbcheck.get_originating_time4  s<     (;;SA  u-=,,,r   c                 &   t               }t               }g }|j                  | j                        }t        t        j
                  |      }|j                  j                  D ]  }| j                  j                  |j                        }	|j                  |	j                                |j                  |j                         | j                  j                  |	|      }
|
|j                  k7  s|j                  |j                          |||fS )zgRead metadata properties and list attributes in it.
           raises KeyError if the attid is unknown.is_schema_nc)r   is_child_ofrx   r	   r   r  r  r  r?   get_lDAPDisplayName_by_attidr  r   r  r   get_attid_from_lDAPDisplayName)r   r   r8  set_attwrong_attids
list_attidin_schema_ncr  r   attcorrect_attids              r#   process_metadatazdbcheck.process_metadataA  s     %u
~~dnn5(;;SA 	*A##@@ICKK		$agg& --LLSZf M hM'  )	* \22r   c                    t        t        t        j                  |d   d               }t	        j
                  | j                  d|z        }| j                  j                  |t        j                  |gddg      }|d   }t	        j                         }||_
        t	        j                  ||   t        j                  |      ||<   | j                  |g dd|z        r| j                  d	|z         y
y
)zre-write replPropertyMetaData elements for a single attribute for a
        object. This is used to fix missing replPropertyMetaData elementsr  r   r  r  r   r   )r   r   r   'Failed to fix metadata for attribute %szFixed metadata for attribute %sN)r   r	   r   r   rq   rr   r=   r   r   r   r   r   r   r   r   )r   r  attrguid_strr   r   r  nmsgs           r#   fix_metadatazdbcheck.fix_metadataW  s     z$))S->q-ABCVVDJJh 67jjRs~~dV*>*;*=   > !f{{}''D	33G3GNT
>>$ MCdJLKK9D@ALr   c                    |j                   t        j                  z  ry d}|j                  t        j                  k(  rd}n_|j                  t        j
                  k(  rd}n?|j                  t        j                  k(  rd}n|j                  t        j                  k(  rd}|sy |j                  j                   t        j                  z  sy t        |j                  j                        S )NFT)flagsr   SEC_ACE_FLAG_INHERIT_ONLYtype"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT!SEC_ACE_TYPE_ACCESS_DENIED_OBJECT SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT SEC_ACE_TYPE_SYSTEM_ALARM_OBJECTr   %SEC_ACE_INHERITED_OBJECT_TYPE_PRESENTr   inherited_type)r   acechecks      r#    ace_get_effective_inherited_typez(dbcheck.ace_get_effective_inherited_typeg  s    99x99988xBBBEXXCCCEXXBBBEXXBBBEzz("P"PP3::,,--r   c                    || j                   v r| j                   |   S d|z  }| j                  j                  | j                  |dg      }t	        t        t        j                  |d   d   d               }|| j                   |<   |S )Nz0(&(ldapDisplayName=%s)(objectClass=classSchema))schemaIDGUID)r*   r4   r,   r   )r|   r=   r   rx   r   r	   r   r   )r   clsfltr   r  s        r#   lookup_class_schemaIDGUIDz!dbcheck.lookup_class_schemaIDGUID}  s    $)))**3//@3FjjT^^+.'5&6   8 
499c!f^&<Q&?@A'($r   c                    d}||   }t        t        j                  |d         }d|v xr" t        |d   d         j	                         dk(  }|r|d fS t        j                         }|j
                  |_        |j                  |_        |j                  |_        |j                  |_        d}d }	g }
|j                  |j                  j                  }
t        dt        |
            D ]V  }|
|   }|j                  t        j                  z  s|j                  |       7| j!                  |      }|K|	||	k7  rd}U|}	X g }
|j"                  |j"                  j                  }
t        dt        |
            D ]V  }|
|   }|j                  t        j                  z  s|j%                  |       7| j!                  |      }|K|	||	k7  rd}U|}	X |r||fS |	|d fS d }	 |d   d   }|k| j(                  j+                  |t,        j.                  ddgd	g
      }|d   }d|v xr" t        |d   d         j	                         dk(  }|r|d fS |d   d   }| j1                  |      }||	k7  r||fS |d fS # t&        $ r
}Y d }~d }~ww xY w)NnTSecurityDescriptorr   r  r  FTobjectClassrZ  r   r   )r	   r   
descriptorr   r  	owner_sid	group_sidrT  revisionsaclacesr4  r   rR  SEC_ACE_FLAG_INHERITED_ACEsacl_addr]  dacldacl_addr   r=   r   rq   r   rb  )r   r   r  sd_attrsd_valsdr&  sd_cleanbrokenlast_inherited_typerk  r:  r[  r  r`  r`  r   r   s                     r#   
process_sdzdbcheck.process_sd  s   (W++VAY7 C'VCK0@0C,D,J,J,LPV,V
:&&(\\\\KK"7777<<Dq#d)$ 	$Aq'C99xBBB!!#&55c:Ay".++ "F"#+	$. 7777<<Dq#d)$ 	$Aq'C99xBBB!!#&55c:Ay".++ "F"#+	$. b>!&:	m$R(C ;**##3>>+6*F.?-@ $ BC AA$)Vc!K.2C.D.J.J.LPV.VJDz!M"2&C**3/##b>! Dz+  		s   "I5 5	JJc                    d}t        |      }t        j                  t        j                  z  }| j	                  d|d|dd      s| j                  d|d|d       yt        j                         }||_        t        j                  |t        j                  |      ||<   | j                  |d	|z  gd
|z        r| j                  d|d|d       yy)z/re-write the SD due to incorrect inherited ACEsrd  Fix r  r,  r\   Not fixing 
Nsd_flags:1:%dFailed to fix attribute %sFixed attribute 'r  '
)r
   r   SECINFO_DACLSECINFO_SACLr   r   rq   r   r   r   r   r   )r   r   rr  	sd_brokenrp  rq  sd_flagsrO  s           r#   err_wrong_sdzdbcheck.err_wrong_sd  s    ("((8+@+@@7B ?A[\KK7B?@{{}**633G3GQW>>$8!; <6@BKKGRHIBr   c                 0   d}t        |      }t        j                  t        j                  z  }|j                  |t        j
                  z  }|j                  |t        j                  z  }| j                  d|d|d|d      s| j                  d|d|d       yt        j                         }||_        t        j                  |t        j                  |      ||<   | j                  |d	|z  gd
|z        r| j                  d|d|d       yy)zare-write the SD due to not matching the default (optional mode for fixing an incorrect provision)rd  NzReset r  z back to provision default?
ro   zNot resetting rz  r{  zFailed to reset attribute %sr}  r  r~  )r
   r   r  r  rg  SECINFO_OWNERrh  SECINFO_GROUPr   r   rq   r   r   r   r   r   )r   r   rr  diffrp  rq  r  r  s           r#   err_wrong_default_sdzdbcheck.err_wrong_default_sd  s    ("((8+@+@@<<#...H<<#...HSZ\^`d e  hC  DKKgrBCKKM''0D0DgN'
>>!o8987BDKKGRHIDr   c                 B   d}t        |      }t        j                  t        j                  z  }| j	                  d|d|dd      s| j                  d|d|d       yt        j                         }||_        t        j                  |t        j                  |      ||<   | j                  j                  | j                         | j                  |d	|z  gd
|z        r| j                  d|d|d       | j                  j                  | j                         y)z/re-write the SD due to a missing owner or grouprd  zFix missing owner or group in r  r,  r]   z"Not fixing missing owner or group rz  Nr{  rL  r}  r  r~  )r
   r   r  r  r   r   rq   r   r   r   r   r=   set_session_infor   r   r   )r   r   rr  rp  rq  r  rO  s          r#   err_missing_sd_ownerzdbcheck.err_missing_sd_owner  s    ("))H,B,BBWVX Y  \B  CKK'SUVW{{}**633G3GQW 	

##D$;$;<>>$8!; <CgMOKKGRHI

##D$<$<=r   c                    | j                   ry|| j                  v ryt        t        j                  |      }| j                  |t        j                        }t        j                  |j                        }t        j                         }| j                  dz  }||z
  }||k  ry||z   }	|dz  }
|
dk  rA| j                  d|z         | j                  dt        j                  |	      |dz  fz         n=| j                  d|z         | j                  dt        j                  |	      |
fz         | j                  d	|j                  |j                   |j"                  |j$                  |j&                  t        j                  t        j                  |j                              fz         | xj(                  d
z  c_        y)NFQ    z`SKIPPING additional checks on object %s which very recently became an expired tombstone (normal)zbINFO: it is expected this will be expunged by the next daily task some time after %s, %d hours agoi  z+SKIPPING: object %s is an expired tombstonezTINFO: it was expected this object would have been expunged soon after%s, %d days agozHisDeleted: attid=0x%08x version=%d invocation=%s usn=%s (local=%s) at %sr5   T)rm   r   r	   r   r  r;  r   r  sambanttime2unixr  timer9   r   ctimer  versionoriginating_invocation_idr  r  rn   )r   r   repl_valr  r  delete_timecurrent_timetombstone_deltar   expunge_time
delta_dayss              r#   is_expired_tombstonezdbcheck.is_expired_tombstone8  s   (( 000 (;;XF((w/N/NO	''	(I(IJyy{00LA{*O#"_4l+
?KK ?ACD E KK '  ::l3Uw5GHI J
 KKEJKKK *  ::l3Z@A B
 	^OO%%77--''JJu001R1RSTbV V 	W 	1$r   c                 .   t        t        j                  |      }| j                  |t        j
                        }t        j                  |j                        }| j                  dz  }g }|j                  j                  D ]  }|j                  t        j
                  k(  r!|j                  |j                  k  r;|j                  |j                  k  rUt        j                  |j                        }||z
  }	|	|k  r|j                  |        ||fS )Nr  )r	   r   r  r;  r   r  r  r  r  r9   r  r  r  r  r   )
r   r  r  r  r  r  foundr   change_timer   s
             r#   find_changes_after_deletionz#dbcheck.find_changes_after_deletionn  s    (;;XF((w/N/NO	''	(I(IJ00LA 	Aww'999{{i111((I,M,MM++A,E,EFK+-E' LLO)	, ir   c                       j                  |      \  }}t        |      dk(  ry fd} j                  d|z          ||       |D ]
  } ||        y)Nr   Fc                    	 j                   j                  | j                        }j	                  d|| j                  | j
                  | j                  | j                  | j                  t        j                  t        j                  | j                              fz         y # t        $ r d| j                  z  }Y w xY w)N<unknown:0x%x08x>zA%s: attid=0x%08x version=%d invocation=%s usn=%s (local=%s) at %s)r?   rB  r  r   r   r  r  r  r  r  r  r  r  r  )r   attnamer   s     r#   report_attidz8dbcheck.has_changes_after_deletion.<locals>.report_attid  s    8++HHQ KK[!))33))

5#4#4Q5N5N#OP_R R S  8-78s   %B& &C Cz,ERROR: object %s, has changes after deletionT)r  r   r   )r   r   r  r  r  r  r   s   `      r#   has_changes_after_deletionz"dbcheck.has_changes_after_deletion  sc    ;;HEyu:?	S 	BRGHY 	AO	 r   c                 X   | j                  |      \  }}|j                  | j                        }|j                         }| j                  j                  ||      }g }|D ]  }	|	j                  |k(  r|	j                  t        j                  k(  r1|	j                  t        j                  k(  rO	 | j                  j                  |	j                        }
|j                  |
        t        |      dkD  r5| j                  ddj                  |      z         | j                  d       y | j!                  d|d| j"                  d	d
      s| j                  d       y | j%                  |dgd|z        r| j                  d|z         y y # t        $ r d|	j                  z  }
Y w xY w)Nr?  r  r   zUnexpeted attributes: %sr   z%Not fixing changes after deletion bugzDelete broken tombstone object z	 deleted z
 days ago?r   r   rL  rM  )r  rA  rx   get_rdn_namer?   rC  r  r   DRSUAPI_ATTID_nameDRSUAPI_ATTID_lastKnownParentrB  r   r   r   r   r   r   r9   r  )r   r   r  r  r  rG  r  	rdn_attid
unexpectedr   r  s              r#   err_changes_after_deletionz"dbcheck.err_changes_after_deletion  s   ;;HEy~~dnn5??$%%DDXBN E P	 
 	'Aww)#ww'444ww'???8++HHQ g&	' z?QKK2SXXj5IIJKK?@ "D$:$:!<=]_KK?@>>"yk2R79KK",-9  8-78s   1%FF)(F)c                    t        t        j                  |      }|j                  }d}|j                  D ]  }|j
                  t        j                  d      k7  r&d}| j                  d||j                  |j                  t        j                  t        j                  |j                              | j                   j#                         fz          |S )NF$00000000-0000-0000-0000-000000000000Ta  ERROR: on replPropertyMetaData of %s, the instanceType on attribute 0x%08x,
                           version %d changed at %s is 00000000-0000-0000-0000-000000000000,
                           but should be non-zero.  Proposed fix is to set to our invocationID (%s).)r	   r   r  r  r  r  r   r   r   r  r  r  r  r  r  r  r=   get_invocation_id)r   r   repl_meta_datar  r  r  r   s          r#   "has_replmetadata_zero_invocationidz*dbcheck.has_replmetadata_zero_invocationid  s    (;;(*hh 	<A**dii8^.__EKK h qww		::e&7&78Q8Q&RS::779;; <	< r   c           	         t        t        j                  |      }|j                  }t	        j
                  t        t        j                                     }d}|j                  D ]  }|j                  t        j                  d      k7  r&d}| j                  j                  t        j                        }	|j                   dz   |_        ||_        t        j                  | j                  j%                               |_	        |	|_        |	|_         |rt+        |      }
t        j,                         }||_        | j1                  d|d|d| j                  j%                         dd	      s| j3                  d
|d|d       y t        j,                         }||_        t        j4                  |
t        j6                  |      ||<   | j9                  |dt:        j<                  z  dgd|z        r| j3                  d|d|d       y y y )NFr  Tr5   rx  r  zK by setting originating_invocation_id on some elements to our invocationID r,  ra   z-Not fixing zero originating_invocation_id in rz  r  #local_oid:1.3.6.1.4.1.7165.4.3.14:0r|  r}  r  r~  )r	   r   r  r  r  unix2nttimer   r  r  r  r   r   r=   sequence_numberrq   SEQ_NEXTr  r  r  r  r  r
   r   r   r   r   r   r   r   r   r  )r   r   rM  r  r  r  nowr  r   seqreplBlobr  rO  s                r#   "err_replmetadata_zero_invocationidz*dbcheck.err_replmetadata_zero_invocationid  s   (;;(*hhDIIK 01 	A**dii8^.__E**,,S\\:C		AAI(+A%*.))DJJ4P4P4R*SA' #AAK	 ~H++-CCF##'+R1M1M1O%QRvxY]_abc;;=DDG++Hc6J6JDQDJ~~d%58c8c%c%J%L:TAC bIJC r   c                     t        t        j                  |      }|j                  }|j                  D ](  }	 | j
                  j                  |j                        }* y # t        $ r% | j                  d|j                  ||fz         Y  y w xY w)NzIERROR: attributeID 0X%0X is not known in our schema, not fixing %s on %s
)
r	   r   r  r  r  r?   rB  r  r   r   )r   r   rM  r  r  r  r   rH  s           r#   err_replmetadata_unknown_attidz&dbcheck.err_replmetadata_unknown_attid  s    (;;(*hh 	A''DDQWWM	  hlmlslsuy{}k~~s   %A*BBc           
      `   t        t        j                  |      }d}t               }t               }i }	|j	                  | j
                        }
|j                  }t        |j                  d d  d       |_        t        |j                        D ]  }t        d||j                  fz         | j                  j                  |j                        }|j                         |v r| j                  d|d|d|d       | j!                  d	|||j                  ||	|   j                  fz  d
      s$| j                  d|j                  |||fz          y d}|j#                  |j                         |j$                  |	|   j$                  kD  rd|j&                  |	|   _        |j(                  |	|   _        |j*                  |	|   _        |j,                  |	|   _        |j$                  |	|   _        e||	|<   |j#                  |j                                 |j                  D cg c]  }|j                  |vs| }}t/        |      dkD  r|D ]  }|j                  |v s| j                  j                  |j                        }| j                  j1                  ||
      }| j                  d|d|d       | j!                  d|||j                  ||	|   j                  fz  d      s%| j                  d|j                  ||||fz          y d}||_         |rt        |d d  d       |d d  |sJ| j                  d|d|d       | j!                  d|d|dd      s| j                  d|d|d       y t/        |      |_        ||_        t5        |      }t7        j8                         }||_        t7        j<                  |t6        j>                  |      ||<   | jA                  |dtB        jD                  z  ddgd|z        r| j                  d|d|d       y y c c}w ) NFc                     | j                   S r"  r  r   s    r#   <lambda>z:dbcheck.err_replmetadata_incorrect_attid.<locals>.<lambda>!  s
    qww r   )keyz
%s: 0x%08xz(ERROR: duplicate attributeID values for r*  r  rz  zLFix %s on %s by removing the duplicate value 0x%08x for %s (keeping 0x%08x)?rb   z5Not fixing duplicate value 0x%08x for %s in %s on %s
Tr   r?  z'ERROR: incorrect attributeID values in zEFix %s on %s by replacing incorrect value 0x%08x for %s (new 0x%08x)?rc   zANot fixing incorrect value 0x%08x with 0x%08x for %s in %s on %s
c                     | j                   S r"  r  r  s    r#   r  z:dbcheck.err_replmetadata_incorrect_attid.<locals>.<lambda>X  s
     r   z&ERROR: unsorted attributeID values in rx  z by sorting the attribute list?rd   ry  r  r  z#local_oid:1.3.6.1.4.1.7165.4.3.25:0r|  r}  r  r~  )#r	   r   r  r   rA  rx   r  r  r  reversedr   r  r?   rB  r  r   r   r   r  r  r  r  r  r   rC  countr
   rq   r   r   r   r   r   r   r  )r   r   rM  r  rE  r  rA   rD  remove_attidhash_attrG  r  r   rH  new_listrI  r  rO  s                     r#    err_replmetadata_incorrect_attidz(dbcheck.err_replmetadata_incorrect_attid  s   (;;(*%u~~dnn5hh 399Q<->?	 #))$ 	%A,"agg./##@@ICyy{g%Z]_ceghi''(v+/QWWc8C=CVCV*W)X(JL KK X#$77Cr":!; <  ) ;;#!8!88
 -.IIHSM)<=<U<UHSM9>?>Y>YHSM;454E4EHSM1./kkHSM+ HSMKK		$?	%D  #yyH!AGG<,GAHH! ,77l*++HHQC$($5$5$T$TUXgs$T$tMKKW[]_ `a++,s/3R#xPS}GZGZ.[-\]{}$h'(wwsD"&M%N OC+AG, $Xa[6GH KKdTVWX##'+R%12SUtR@A M		D>{{}''#2F2FMT
>>$!1D4_4_!_!F!F!H 7=? KKD"EF	?I Is   )P+=P+c                    d}d|vr | j                  d|j                  z         d}d|vs"t        |d   d         j                         dk(  r | j                  d|j                  z         d}d	|vr | j                  d
|j                  z         d}d|vs"t        |d   d         j                         dk(  r | j                  d|j                  z         d}d|v r | j                  d|j                  z         d}d|v rBt        |d   d         j                         dk(  r | j                  d|j                  z         d}d|vs9t	        |d         dk7  s(t        |d   d         dk7  st        |d   d         dk7  r | j                  d|j                  z         d}d|vst        |d   d         dk7  r | j                  d|j                  z         d}|S )NFdescriptionz>ERROR: description not present on Deleted Objects container %sTshowInAdvancedViewOnlyr   FALSEzIERROR: showInAdvancedViewOnly not present on Deleted Objects container %sobjectCategoryzAERROR: objectCategory not present on Deleted Objects container %sisCriticalSystemObjectzIERROR: isCriticalSystemObject not present on Deleted Objects container %s
isRecycledz9ERROR: isRecycled present on Deleted Objects container %sr  z8ERROR: isDeleted not set on Deleted Objects container %sre  r  topr5   	containerzBERROR: objectClass incorrectly set on Deleted Objects container %ssystemFlags-1946157056zBERROR: systemFlags incorrectly set on Deleted Objects container %s)r   r   r   r  r   )r   r  faultys      r#   is_deleted_deleted_objectsz"dbcheck.is_deleted_deleted_objectsq  s   #KKX[^[a[aabF#3.#c:R6STU6V2W2]2]2_cj2jKKcfiflfllmF3&KK[^a^d^ddeF#3.#c:R6STU6V2W2]2]2_cj2jKKcfiflfllmF3KKSVYV\V\\]F##c+&6q&9":"@"@"Bg"MKKRUXU[U[[\F#C,>(?1(D(+C,>q,A(Be(K(+C,>q,A(Bk(QKK\_b_e_eefF#s3}+=a+@'A]'RKK\_b_e_eefFr   c                    t        j                         }|j                  x|_        }d|vr(t        j                  dt         j                  d      |d<   d|vr(t        j                  dt         j                  d      |d<   d|vr5t        j                  d| j
                  z  t         j                  d      |d<   d|vr(t        j                  dt         j                  d      |d<   d|v r(t        j                  dt         j                  d      |d<   t        j                  dt         j                  d	      |d	<   t        j                  d
t         j                  d      |d<   t        j                  ddgt         j                  d      |d<   | j                  d|z  d      s| j                  d|z         y | j                  |dgd|z        r| j                  d|z         y y )Nr  zContainer for deleted objectsr  r  r  zCN=Container,%sr  r  r  r  r  r  r  re  zAFix Deleted Objects container %s by restoring default attributes?re   .Not fixing missing/incorrect attributes on %s
r   z+Failed to fix Deleted Objects container  %sz%Fixed Deleted Objects container '%s'
)
rq   r   r   r   r   rx   r-  r   r   r   )r   r  rO  r   s       r#   err_deleted_deleted_objectsz#dbcheck.err_deleted_deleted_objects  s   {{}vv"#"%"4"45TVYVjVjly"zD#3.-0-?-?H\H\^v-wD)*3&%(%7%78IDNN8Z\_\p\p  sC  &DD!"#3.-0-?-?H\H\^v-wD)*3!$!3!3FC<O<OQ]!^D..vs7K7K[Y[!00@T@TVcd]!00%1EsG[G[]jk] c#%!'(EGKKIRPQ>>$G"LNKK@BGHNr   c                 >   t        j                         }||_        | j                  j	                         }| j                  j                         r#| j                  d|d|j                  d       y | j                  d|j                  z  d      s| j                  d|j                  z         y t        j                  |t         j                  |      ||<   | j                  |g d|d|j                        r"| j                  d	|d|j                         y y )
Nry  r  z for the RODCz-Add yourself to the replica locations for %s?r   r  zFailed to add  for rk  )rq   r   r   r=   rz   am_rodcr   r   r   r5  r   )r   r  	cross_refrM  rO  targets         r#   err_replica_locationszdbcheck.err_replica_locations  s    {{}--/::KK4HI O#&66!+,CEKKISVVTU''0@0@$GT
>>$svv$NOKKT366:; Pr   c                     || j                   j                  k(  ry|| j                  k(  ry|| j                  k(  ry|| j                  k(  ry|| j
                  k(  ryy)NTF)r=   rs   rt   rv   rx   ry   rO  s     r#   is_fsmo_rolezdbcheck.is_fsmo_role  sX    %%%'''r   c                 :   d}| j                   j                  |      }||k(  rc|t        j                  z  }	 | j                   j	                  |j                         t        j                  g dg       |t        j                  z  }| j                  At        |      | j                  D cg c]  }t        |       c}v r|t        j                  z  }|S # t        j                  $ r-}|j                  \  }}|t        j                  k7  r Y d }~d }~ww xY wc c}w )Nr   r   r   )r=   rN  r   INSTANCE_TYPE_IS_NC_HEADr   r  rq   r   INSTANCE_TYPE_NC_ABOVEr   r   r   r   r   INSTANCE_TYPE_WRITE)r   r   instancetyper^  e4r   r   xs           r#   calculate_instancetypezdbcheck.calculate_instancetype  s    **((,=D999L<

!!ryy{#..PR^o]p!q  ; ;;>>%#g,4>>:Za3q6:Z*ZD444L << !wwt3111 2 ;[s   <C *DD(#DDc                     | j                   D ]e  \  }}||k(  st        j                  | j                  j	                               }t        t        j                   ||| j                              c S  t        )Nr   )	r}   r   r   r=   r   r	   rf  r   r   )r   r   sd_dndescriptor_fnr   s        r#   get_wellknown_sdzdbcheck.get_wellknown_sd  sr    &*&8&8 	I"UMU{%--djj.G.G.IJ
!("5"5"/
9=#HI I	I r   c                   	 |dgnt        |      t        d D              		fd}d	v s$d	v s |j                         j                         	v r"j	                  d       	j                  d       d	v r |j                         ddfD ]
  } ||        d	}d	v rd
}n*D ]%  }| j                  |      \  }}|dk(  r|dz  r#d
} n |r |d        |d       	fS )zA helper function for check_object() that calculates the list of
        attributes that need to be checked, and returns that as a list
        in the original case, and a set normalised to lowercase (for
        easy existence checks).
        *c              3   <   K   | ]  }|j                           y wr"  )r  ).0r  s     r#   	<genexpr>z/dbcheck.find_checkable_attrs.<locals>.<genexpr>  s     0Qqwwy0s   c                     | j                         vr1j                  |        j                  | j                                y y r"  )r  r   r   )ar,   lc_attrss    r#   add_attrz.dbcheck.find_checkable_attrs.<locals>.add_attr  s3    wwy(QQWWY' )r   r   distinguishednamenamer  r  FTr   r5   r  r  )rD  r   r  r  r   r   r(  )
r   r   r   r  r  need_replPropertyMetaDatar&  r\  r,   r  s
           @@r#   find_checkable_attrszdbcheck.find_checkable_attrs  s    "EE)E0%00	(
 H8+OO##%1LL LL Xoo'!#%  
 %*!(?(,%  AA!D	Q;A:,0) %+,hr   c           
      (   | j                   r| j                  d|z         | j                  ||      \  }}	 d}|t        j                  z  }|t        j
                  z  }|t        j                  z  }|t        j                  z  }| j                  j                  |t        j                  dddd|z  dg|      }t!        |      dk7  r| j                  d|z         y|d   }
d}t#               }t#               }d}| j                  j%                  |
j&                        }	 | j                  j)                  |t*        j,                  j.                        }d
}d
}d
}d}d}d
}|
D ]k  }|j3                         dk(  rt5        |
|   d         dk7  rd}|j3                         dk(  rt7        |
|   d         }|j3                         dk(  sd|
|   d   }m |rA|r?| j9                  ||      r|dz  }| j;                  ||       |S | j=                  ||      r|S |
D ]  }|dk(  s|dk(  r|j3                         dk(  rd}|j3                         dk(  rnt!        |
|         dk7  rL| xj>                  dz  c_        | j                  dt!        |
|         |t5        |
j&                        fz         nt5        |
|   d         }|j3                         t5        |
j&                  jA                               j3                         k(  rp|}t!        |
|         dk7  rL| xj>                  dz  c_        | j                  dt!        |
|         |t5        |
j&                        fz         nt5        |
|   d         }|j3                         dk(  r| jC                  ||
|   d         r|dz  }| jE                  |||
|   d          	 | jG                  ||
|   d         \  }}}t!        |      t!        |      k  st!        |      dkD  stK        |      |k7  r |dz  }| jM                  |||
|   d   |       n>|d   dk7  r6| xj>                  dz  c_        | j                  d|dt5        |      d       P|j3                         dk(  r| jO                  ||
      \  }}|| jQ                  |||       |dz  }|jR                  |jT                  | jW                  ||       |dz  }||k(  s| jX                  r	 | j[                  |      }t]        t        j^                  |
|   d         }d}| jX                  sd}ta        ||t        jb                  | j                  je                               |      }|dk7  r| jg                  |||       |dz  }rt|j3                         dk(  r| j                  ji                  | jj                  ||
|         } tK        |       tK        |
|         k7  s| d   |
|   d   k7  s| d   |
|   d   k7  r$| jm                  ||to        |
|                |dz  }|j3                         dk(  r|
|   d   }!|!d k(  r|dz  }| jq                  |
||
|          K|!d
d! d"k(  rU|!d
d# d$k(  r|dz  }| js                  |
||
|          z|!d   dk7  r=|!d%   dk7  r5|!d&   dk7  r-|!d'   dk7  r%|!d(   dk7  r|dz  }| ju                  |
||
|          t!        |!      d)z  dk7  r|dz  }| jw                  |
|       |!d   dk(  r=|!d)   dk(  r5|!d%   dk(  r-|!d*   dk7  r%|!d&   dk(  r|dz  }| jy                  |
||
|          .|j3                         d+k(  s|j3                         d,k(  rv|
|   d   | jz                  v rA| xj>                  dz  c_        | j                  d-|d.|
j&                  d/|
|   d   d0       n!| jz                  j}                  |
|   d          |
|   D ]  }"|"d1k(  s	| j                  ||       |dz  }! 	 | jj                  j                  |      }#| j                  |      \  }%}&| jj                  j                  |      }'|'t,        j                  z  s4|'t,        j                  z  s!|%s|j}                  |j3                                |#t,        j                  t,        j                  t,        j                  t        j                  fv r|| j                  |
||#      z  }nt#               }(|
|   D ]n  }"|(j}                  |"       | j                  ji                  | jj                  ||"g      } t!        |       dk7  s	| d   |"k7  sS| j                  |||
|          |dz  } n t!        |
|         t!        |(      k7  r'| j                  |||
|   to        |(             |dz  } ng|j3                         d2k(  s| j                  |      })t!        |
d3         dk7  st7        |
d3   d         |)k7  s|dz  }| j                  |
|)        |sd4|v sd|v r|dz  }| j                  |       d4|v sd|v r|<| xj>                  dz  c_        | j                  d5t5        |
j&                        z         |X| xj>                  dz  c_        | j                  d6|
j&                  jA                         dt5        |
j&                        d7       |Gd
}*dd8g}+|r6|t*        j,                  j                  z  s|}*|+d9t,        j                  z  gz  }+|*|
j&                  j                         }*	 t        j                  | j                  d:|*z        },|,j                  d|
j&                  jA                         |       |
j&                  |k(  r|
j&                  },|,|
j&                  k7  r|dz  }| j                  |
|,||||+       nX|
j&                  j                         |k7  r;| xj>                  dz  c_        | j                  d;|d<|d=|
j&                  d7       	 d}.|rO|
j&                  |k(  rd@}/dA}0| j                  ||/      }1|1|0k7  r| j                  dBt5        |      z  dC      rgt        j                         }2||2_        t        j                  dDt        j                  dE      |2dE<   |dz  }| j                  j                  |2dFgG       n| j                  dHt5        |      z         |j                  |      D ]o  }3|.r| j                  dI|z         d}.|dz  }| j                  dJ|3z         | j                  dK|3z  dL      s| j                  dM|3z         ^| j                  |
|3       q | j                  |      r"dN|
vrd4|v sdO|v r| j                  |
       |dz  }	 || j                  j                         k7  rat5        |j                               | j                  vr<| j                  j                  |j                         t        j                  ddgP      }|| j                  v r+d4|v r'| j                  |
      r| j                  |
       |dz  }| j                  D ]  \  }5}$||5k(  sdS|
v sdT}6| j                  j                         rdU}6|6|$vr#| j                  |
|$j&                  |6       |dz  }Vd}7|$|6   D ]+  }8t5        |8      | j                  j                         k(  s*d}7- |7r| j                  |
|$j&                  |6       |dz  } || j                  k(  rd4|v sdV|v rdW|
vr|dz  }| j                  rb| j                  dXdY      r~| j                  j                          	 | j                  j                          | j                  j                          n.| j                  j                         s| j                  dZ|z         || j                  k(  rd[d\g}9| j                  j                  | j                  t        j                  |9]      }|9D ]a  }:|:|d   vrt7        |d   |:   d         };|;d^z	  }<d_|;z  }=|;dk7  s/|=|<k\  s5| j                  d`|=|<|=|<fz         | xj>                  dz  c_        c d[|d   vr)| j                  da|z         | xj>                  dz  c_        	 | j                  j                         \  }>}<| j                  je                         }?|>|<k  rdb|?|>fz  }@	 | j                  j                  dc@z  t        j                  g ]      }|| j                  dd@de|d   j&                  df|       |dz  }| j                  dg|@dh|didj      r^| j                  j                          	 	 | j                  j                         }A|A|>k\  rAdz   }>n&	 | j                  j                          n	 |S |>dz  }>|>|<k  r|S |S # t        j                  $ rR}|j                  \  }}	|t        j                  k(  r*| j                  r| j                  d	|z         Y d
}~yY d
}~y d
}~ww xY w# t0        $ r d
}Y w xY w# t0        $ r |dz  }| jI                  |||
|          Y qw xY w# t0        $ r Y w xY w# t        $ r"}$| j                  |
|       |dz  }Y d
}$~$d
}$~$ww xY w# t        $ r5}-| xj>                  dz  c_        | j                  d>|* d?       Y d
}-~-d
}-~-ww xY w# t        j                  $ rw}4|4j                  \  }}	|t        j                  k(  rI|r0| j                  dQ|
j&                  z         | j                  dR       n| j                  |
       |dz  }n Y d
}4~4gd
}4~4ww xY w#  | j                  j                           xY w# t        j                  $ r0}-|-j                  \  }}	|t        j                  k7  r d
}Y d
}-~-d
}-~-ww xY w#  | j                  j                           xY w# t        j                  $ rC}BBj                  \  }}	| j                  dk|	z         | xj>                  dz  c_        Y d
}B~B|S d
}B~Bww xY w)lzcheck one objectChecking object %sr   r   r   r   r{  r   )r*   r+   r   r,   z)ERROR: Object %s disappeared during checkNr5   z,ERROR: Object %s failed to load during checkF	isdeletedr  Tsystemflagsreplpropertymetadatar   distinguishedNameobjectclassr  z1ERROR: Not fixing num_values(%d) for '%s' on '%s'z4ERROR: Not fixing incorrect initial attributeID in 'z' on 'z', it should be objectClassntsecuritydescriptor)ignoreAdditionalACEsr/   rZ  userparameters       s                      s   IAAgACAAIAAgACAAIAAg   r   r   	   r  r   attributeid	governsidzError: r  r  z. already exists as an attributeId or governsIdr   r  r  r  z(ERROR: Not fixing missing 'name' on '%s'zERROR: Not fixing missing 'r0  r   rr  z
RDN=RDN,%szERROR: Not fixing r  z on 'z#ERROR: could not handle parent DN 'z': skipping RDN checksi0  l   )x1cB& z-Fix isDeleted originating_change_time on '%s'rS   r  r  r   r   z4Not fixing isDeleted originating_change_time on '%s'zOn object %sz7ERROR: Attribute %s not present in replication metadataz-Fix missing replPropertyMetaData element '%s'rR   z4Not fixing missing replPropertyMetaData element '%s'r  fsmoroleowner)r*   r+   r   z'WARNING: parent object not found for %szFNot moving to LostAndFound (tombstone garbage collection in progress?)repsFromr2   r3   ridsetreferencesr8   z,Allocate the missing RID set for RID master?r   z^No RID Set found for this server: %s, and we are not the RID Master (so can not self-allocate)rIDAllocationPoolrIDPreviousAllocationPoolr)       l    z!Invalid RID pool %d-%d, %d >= %d!z No rIDAllocationPool found in %sz%s-%dz<SID=%s>zSID r  z' conflicts with our current RID set in zFix conflict between SID z and RID pool in z by allocating a new RID?rj   zCouldn't get available RIDs: %s)vr@   r   r  r   r  r  r  r  r=   r   rq   r   r   r   r   rp   r   r   rN  r   r   r  r   r   r   r  r   r   r  r  r  r   r  r  r  rJ  r  r  r  rv  r  rg  rh  r  rl   r  r	   rf  r   r   r   r  r3  r?   rE  rD  r  r  r  r  r  r   r   r.  r  r  r  r(  $get_systemFlags_from_lDAPDisplayNameDS_FLAG_ATTR_NOT_REPLICATEDDS_FLAG_ATTR_IS_CONSTRUCTEDr   DSDB_SYNTAX_OR_NAMEDSDB_SYNTAX_STRING_DNr  r9  r<  rH  r  r  rP  #SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETErs  r  rr   set_componentr  get_rdn_value
ValueErrorr=  r   r   r   r   r  
differencerP  r  r  r   r   r  r   r  r  r   r  r  rz   r   r   r  create_own_rid_setr  r  r   free_rid_boundsallocate_rid)Cr   r   r   search_attrsr  r  r   e10r   r   r  r   set_attrs_from_mdset_attrs_seengot_objectclassnc_dndeleted_objects_dnobject_rdn_attrobject_rdn_valr  r  r  repl_meta_data_valr%  list_attid_from_mdrE  rr  r  well_known_sd
current_sdr  r  r9  
userparamsr8  r  r  r&  r]  flagr6  r  	parent_dnr   expected_dnr`  show_dnisDeletedAttIdexpectedTimeDooriginatingrO  rH  e11dns_partlocationr  loc
pool_attrs	pool_attrpoolhighlownext_free_ridr   sidallocated_ridr  sC                                                                      r#   r   zdbcheck.check_object	  s   <<KK,r12 "&!:!:2!Oh	H...H...H---H---H**##3>>(9(9(8(7((B(<.& +7 $ 8C" s8q=KKFKL!fE

&&svv.	&!%!<!<U=BZZ=i=i"k 	! 		6H~~;.s8}Q'(G3 $I~~=0!#h-"23~~#99%(]1%5"		6 +..r3EFq //4FG""((-?@"" U	NH48/B#B~~=0"&~~6)s8}%*))Q.)KK S!$S]!3Xs366{ K!L M  #3x=#34H~~3svv':':'<#=#C#C#EE"*s8}%*))Q.)KK S!$S]!3Xs366{ K!L M &)Xq)9%:N~~#99::2s8}Q?OP1$K;;B#h-XYJZ[//CM!4DE J&(:L ()C0B,CC,'!+/04FF1$K99"hHVWHXZfg
 *!,1--2-%-s2w%8 9 ~~#99"&//"c":Y(%%b"i81$K<<'2<<+?--b"51$K++t/I/I!(,(=(=b(A ",H,?,?,/M!,<">J ,1(55/3,'z(0(8(89R9R9T(U=QSD rz11"mTJ#q( ~~=0!ZZAA$BSBSU]_bck_lm
 *%H)>> ms8}Q'77 nHb(9977Hd3x=FYZ1$K~~#33 ]1-
%1$K11#xXO_7_(??1$K223#h-P !mq( mq( mq( mq( mq(  1$K00hHN_q(A-1$K//X> mq( mq( mq( mq( mq(  1$K33C3x=Q~~=0HNN4D4Sx=#t'B'BB))Q.)KK#+SVVS]15E!G H //33CM!4DE 8} #:,,R:1$K	!..RRS[\
 )-(M(Mh(W%F%$$II(SD4;;;t???""8>>#34d88$:R:R"88#--I I t}}S(JGG x= CJJsO!%!E!EdFWFWYadgch!iJ:!+z!}/C33B#h-P#q( s8}%V4--b(CM4PV<X1$K~~>1*.*E*Eb*I's>*+q0CN8KA8N4OSj4j1$K//5LMkU	Nn C8O}7P1K((,8Ov1%%*%F#cff+VW&%%*%H[H[H]_bcfcici_jklI)95H#ejj&T&TT 2I-0Z0ZZ[[ FFMMO	N!ffTZZ1KL ))!SVV-@-@-BHM66//"%&&K#&&(1$K%%c;*Hh@VV))+~=))Q.)KK_ESEHVV!M N vv++!' "5"778JN[.0''(WZ]^`Za(acvw"{{}"$,/,>,>vsG[G[]h,i[)#q(

))$-)I $Z]`ac]d$de%001BC 	,KK 34#Gq UX[[\''(WZ](]_qrKK VY\ \]!!#s+	, R c)sh/U]B]))#.q 	TZZ//11c"))+6Fdkk6Yjj''RYY[2CEU1V ( X 000SH_..s3005q #22 	%OXsX~*"36::%%'=H3&..sCFFHE1$Kx= %C3x4::#?#?#AA $% ..sCFFHE1$K'	%* ###h"4"@%S0  1$K))++ -:,HJ !JJ88:& $

 = = ? !JJ99;!ZZ//1 %9;=%> ?6  -/JKJ**##*4 $ 6C ( /	CF*3q6),Q/0rz 4'19KK C!$dC 6!7 8))Q.)/ ##a&0>CD%%*%7+&*jj&@&@&B#t "ZZ668
#t+!Z$??C#"jj//Z#5E69nn68 0 : 7:CFIIr%K L#q(++ 03B-8 -G	H
 !JJ88:&&*48JJ4K4K4MM'4'E8E8I(-	 '+ ).
 !JJ99;!  &*Y $t+\ {_ || 	88LT4s---&&KK Kb PQ	*  	& "&	&B   1$K77Hc(mTH $ ! !P  **39q B  3%%*%A) M2 2 3 33v || 	88LT4s---KK ISVV TUKK !N O ++C01$K	|& $

 = = ? %R << #'(vvt3#9#99!"	#<& $

 = = ? %_ << + XX
d=DE%%*%%h o+s+  BAG%  4AI 6AI-AJ
AJ5#AK )A>AL	 7AN B;AP C?/AN6 F'AO< G%AI
G8AAIIAIIAI
IAIIAII$AJJAJJ
	AJJAJJ	AKJ#AK K AKK	ALK*ALLALL	ANLA,ANNANNAN3N6AO9O	%AO4O4AO9O<APPAQ2P/8AQ-Q-AQ2c                    t        j                  | j                  d      }| j                  r| j	                  d|z         | j                  j                  |t         j                        }t        |      dk7  r| j	                  d|z         y|d   }d}d|vr| j	                  d       |dz   S t        |d   d         j                  d	      s!| j	                  d
       |dz  }| j                  d      s|S | j                  j                  t        j                  | j                  |d   d   j                  d            t         j                  dg      }t        t        t        j                  |d   d   d               }t        j                         }||_        t        j"                  d|z  t         j$                  d      |d<   | j'                  |g dd      r| j	                  d       |S )z!check the @ROOTDSE special objectz@ROOTDSEr  )r*   r+   r5   z"Object %s disappeared during checkr   r  z(ERROR: dsServiceName missing in @ROOTDSEz<GUID=z1ERROR: dsServiceName not in GUID form in @ROOTDSEz"Change dsServiceName to GUID form?r1   r  r)   r  z+Failed to change dsServiceName to GUID formFr   z"Changed dsServiceName to GUID form)rq   rr   r=   r@   r   r   r   r   r   r   r  r   r	   r   r   r   r   r   r   r   )r   r   r   r  r   rN  r  s          r#   r   zdbcheck.check_rootdseD  s   VVDJJ
+<<KK,r12jjRs~~>s8q=KK<rAB!f #%KKBC?"3'*+66x@KKKL1K<< DE""**##

C<PQR<S<Z<Z[a<b)c*-.. $ PC:diiQ1Ea1HIJHAAD!$!3!3K(4J474H4H/"[Ao~~a%R]b~c@Ar   c                 >   t        j                         }t        j                  | j                  d      |_        t        j
                  dt         j                  d      |d<   t        j
                  dt         j                  d      |d<   | j                  |g dd      S )	zre-index the whole databasez@ATTRIBUTESr  force_reindexr   r  zre-indexed databaseFr   )	rq   r   rr   r=   r   r   r5  r-  r   r   r  s     r#   reindex_databasezdbcheck.reindex_databaseh  sw    KKMvvdjj-0((1A1A?S%((1D1DoV(~~a%:U~KKr   c                     t        j                         }t        j                  | j                  d      |_        t        j
                  dt         j                  d      |d<   | j                  |g dd      S )zOreset @MODULES to that needed for current sam.ldb (to read a very old database)z@MODULES
samba_dsdbz@LISTzreset @MODULES on databaseFr   )rq   r   rr   r=   r   r   r   r   rC  s     r#   reset_moduleszdbcheck.reset_modulesr  sY    KKMvvdjj*-''c6J6JGT'
~~a%AE~RRr   )
NFFFFFFFFF)FF)T)Fr"  )N__name__
__module____qualname____doc__r   rq   r  r   r   r   r  r   r  r   r   r(  r.  r<  rE  rH  r   rP  rX  ra  rn  rp  rt  rw  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r9  r;  r=  rJ  rP  r]  rb  rv  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r   rD  rG   r   r#   r&   r&   8   s   )DI8=).',*/yv !%C,=,=!%NiV(G*&	A>>>*N$U.I.SjI@I L$]"M@EE GF  04H(C&m"!,FA*wOnp i4\
?:BBd4LhT	3,B .,gRJ"J*>>4l  D2".H(#KJ
]G~<I8<$$/bhXHLSr   r&   )%rq   r  r  base64r   r   r   r   samba.dcerpcr   r   	samba.ndrr	   r
   r   samba.samdbr   r   samba.descriptorr   r   r   
samba.authr   r   samba.netcmdr   samba.netcmd.fsmor   samba.colourr   r   r   r   r$   r   r&   rL  r   r#   <module>rV     s[   (    '      * !  ! 
 5 % 0 H H,Sf ,Sr   