samba.git/python, branch master

pytests: dns_packet tests check rcodes match Windows

2026-04-16T00:54:43+00:00

the dns_packet tests originally checked only for a particular DoS
situation (CVE-2020-10745) but now we widen them to ensure Samba's
replies to invalid packets resembles those of Windows (in particular,
Windows 2012r2). We want Samba to reply only when Windows replies, and
with the same rcode.

At present we fail a lot of these tests.

The original CVE-2020-10745 test is retained and widened indirectly --
any test that leaves the server unable to respond within 0.5 seconds
will count as a failure.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14378

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andreas Schneider

subunit: Do not return successful exit code if tests fail or error

2026-04-07T04:17:08+00:00

TestProtocolClient.writeOutcome() removed items from self.errors and
self.failures via TestProtocolClient._filterErrors(). This made wasSuccessful()
inappropriately return True even if there were errors or failures.
subunit.run.runTests() uses wasSuccessful() to determine the exit code.

To fix this, do not remove items from self.errors or self.failures, but instead
use indices to keep track of how many items we have already processed in each of
self.errors and self.failures.

This fixes a regression introduced by commit
421dc7fc4d83629d3a5f9e558d378f44c7b9dad3.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15691

Signed-off-by: Jennifer Sutton 
Reviewed-by: Gary Lockyer 

Autobuild-User(master): Gary Lockyer 
Autobuild-Date(master): Tue Apr  7 04:17:08 UTC 2026 on atb-devel-224

selftest: Add keywords arguments to addDuration() method

2026-04-07T03:14:34+00:00

Without these, the type checker complains:

Method "addDuration" overrides class "TestResult" in an incompatible manner.

Signed-off-by: Jennifer Sutton 
Reviewed-by: Gary Lockyer

s4/dns_server: add large dns udp truncated packets tests

2026-04-01T04:05:39+00:00

Large DNS response must be truncated over UDP, though this is not yet done in samba. Test is added as knownfail until implementation

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988

Signed-off-by: Andréas Leroux 
Reviewed-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

tests:krb5 expired password handling

2026-03-30T23:37:36+00:00

The windows ADDC checks password validity before password expiry. So an
incorrect expired password will return KDC_ERR_PREAUTH_REQUIRED not
KDC_ERR_KEY_EXPIRED.

The KDC behaviour fixes will be made to lorikeet-heimdal and then imported to
samba.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15746

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

python:tests/krb5: Make PADATA_PK_AS_REP optional in non-strict mode

2026-03-30T10:41:07+00:00

Commit c1433f821f7 added PADATA_PK_AS_REP (PA-PK-AS-REP, type 17) to
the expected padata list when check_rep_padata sees KDC_ERR_KEY_EXPIRED.
This reflects Samba's Heimdal KDC behaviour, which includes PKINIT hints
in expired-password error responses.

Samba with MIT KDC does not include PADATA_PK_AS_REP in KDC_ERR_KEY_EXPIRED
responses; it returns a METHOD-DATA with just the NTSTATUS payload (type 3) and
the FX-COOKIE (type 133).  This causes test_pw_expired to fail intermittently
when the expired-password code path is exercised against MIT KDC.

Add PADATA_PK_AS_REP to the require_strict set alongside PADATA_PK_AS_REP_19,
so it is treated as optional in non-strict checking mode (STRICT_CHECKING=0)
while still being enforced in strict mode.

Signed-off-by: Andreas Schneider 
Reviewed-by: Jennifer Sutton 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Mon Mar 30 10:41:07 UTC 2026 on atb-devel-224

python:tests: Fix assertEqual placement in test_device_group_restrictions

2026-03-30T09:37:33+00:00

The assertEqual calls checking the exception attributes were incorrectly
indented inside the 'with self.assertRaises()' block. When the expected
NTSTATUSError is raised by verify_access(), execution exits the block
immediately, so those lines were never reached.
When the exception is not raised (e.g. with MIT KRB5 1.22 where a spurious FAST
error was fixed), execution falls through to the assertEqual inside the block,
causing AttributeError because error.exception is only available after the
'with' block exits.

The exception returned is NT_STATUS_UNSUCCESSFUL with Heimdal.

Signed-off-by: Andreas Schneider 
Reviewed-by: Jennifer Sutton

test:heimdal:pkinit fixes for SHA1-PUKEY calculation

2026-02-23T20:16:34+00:00

The SHA1 hash for KB5014754 SHA1-PUKEY is calculate over the entire
certificate not just the public key.

BUG https://bugzilla.samba.org/show_bug.cgi?id=16001

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

s4:kdc:db-glue altSecurityIdentities DN and serial reversed

2026-02-23T20:16:34+00:00

When altSecurityIdentities is set by RSAT / ADUC they store the
Issuer and Subject DN in last to first order i.e.
       CN=Common Name, O=Organization, C=Country
Need to reverse that to first to last order, i.e.
       C=Country, O=Organization, CN=Common name
Which is how they're stored on the X509 certificates.

Also the serial number is stored in reverse order.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16001

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

CVE-2026-20833: s4:kdc: Make default domain supported enctypes AES by default

2026-02-18T00:49:34+00:00

If AES keys are available in the domain, assume that service accounts support
AES by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15998

Signed-off-by: Jennifer Sutton 
Reviewed-by: Douglas Bagnall