The main changes required are: - we need to use an s3 loadparm instead of the standard s4 lp. - the s3 SMB bindings don't support the use_spnego/ntlmv2_auth params, however, we can set these in the loadparm instead, which will get the SMB client code to do what we want. Instead of passing in boolean parameters, we need to use yes/no strings that the lp will accept. (We always set these values because the underlying lp context is actually global, and setting a value is 'sticky' and will persist across test cases. These conf settings are only used by the SMB client code, and so will only affect the SMB test cases). - For the no_spnego_no_ntlmv2 test cases, we now explicitly force it to an SMBv1 connection. The s4 bindings only ever supported SMBv1 connections, so this is the same behaviour. The other test cases will now try to negotiate SMBv2 connections, however, the no_ntlmv2 test cases are explicitly checking for bare-NTLM (with the s3 bindings, it now ends up as NTLMSSP by default). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Jan 17 04:47:56 CET 2019 on sn-devel-144
This should not alter the behaviour of the tests at all. It just makes it easier to switch over the underlying SMB client bindings. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
The s3 SMB client bindings seem slightly different to s4, in that they default to setting the CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS flag. This seems to fallback to finding a valid KRB TGT (from a previous successful test), which results in the connection succeeding rather than failing. Setting MUST_USE_KERBEROS explicitly avoids this behaviour. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
The s4 Python bindings currently only support SMBv1 connections. If we change the bindings to support *either* v1 or v2, they'll end up negotiating v2. In which case the server is "SMB2", not "SMB", and these assertions fail. Long-term we want to get rid of SMBv1, so it makes sense to write the tests so that they pass against either v1 or v2. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
Remove Flake8 warnings from the audit and authentication JSON log tests. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Add a new "logonType" element to the Authorisation JSON log messages. This contains a Windows Logon Type, the supported logon types are: 2 Interactive 3 Network 8 NetworkCleartext Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Add a new "eventId" element to the Authorisation JSON log messages. This contains a Windows Event Code Id either: 4624 Successful logon 4625 Unsuccessful logon Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
filter in PY2 returns list in PY3 it returns an iterator Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>