samba.git/python/samba/tests/usage.py, branch master

CVE-2025-10230: s4/tests: check that wins hook sanitizes names

2025-10-21T18:40:37+00:00

An smb.conf can contain a 'wins hook' parameter, which names a script
to run when a WINS name is changed. The man page says

    The second argument is the NetBIOS name. If the name is not a
    legal name then the wins hook is not called. Legal names contain
    only letters, digits, hyphens, underscores and periods.

but it turns out the legality check is not performed if the WINS
server in question is the source4 nbt one. It is not expected that
people will run this server, but they can. This is bad because the
name is passed unescaped into a shell command line, allowing command
injection.

For this test we don't care whether the WINS server is returning an
error code, just whether it is running the wins hook. The tests show
it often runs the hook it shouldn't, though some characters are
incidentally blocked because the name has to fit in a DN before it
gets to the hook, and DNs have a few syntactic restrictions (e.g.,
blocking '<', '>', and ';').

The source3 WINS server that is used by Samba when not run as a DC is
not affected and not here tested.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15903

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

Fix usage test broken by rust vendor sources

2024-10-23T14:21:34+00:00

Signed-off-by: David Mulder 
Reviewed-by: Alexander Bokovoy

python/blackbox: add rpcd_witness_samba_only.py test

2024-01-26T17:00:33+00:00

This tests the witness service and its interaction with
ctdb.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Günther Deschner

python:tests: Move NDR tests to their own directory

2023-11-20T21:50:32+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

python:tests: Ensure that we don’t overwrite tests

2023-05-29T22:32:28+00:00

If the file iterator returns two entries with the same name, one may
overwrite the other.

script_iterator() currently ensures this won’t happen, but it pays to be
safe.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

python:tests: Remove unused imports

2023-05-29T22:32:28+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

python:tests: Exclude Python test directories

2023-05-29T22:32:28+00:00

Practically all of our Kerberos tests are excluded already. Many of our
tests aren’t marked as executable, and so aren’t being checked anyway.
Rather than having a large list of exclusions which one may easily
forget to update, just exclude the test directories.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

tests/krb5: Add tests for authentication policies

2023-05-18T01:03:37+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

selftest: Add python test that verifies that we can parse a PAC

2023-03-31T01:48:30+00:00

This give us a building block to test the PAC claims format

Signed-off-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

tests/krb5: Add tests for device info

2023-03-08T04:39:32+00:00

These tests verify that the groups in the device info structure in the
PAC are exactly as expected under various scenarios.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett