samba.git/source4/setup, branch talloc-2.4.0

s4:setup:tests: Use system ldbdump if we build with system ldb

2022-12-23T15:31:31+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Fri Dec 23 15:31:31 UTC 2022 on sn-devel-184

python:tests: Allocate OID range for testing to avoid collisions

2022-08-25T13:55:47+00:00

sid_strings.py used the same OID range as ldap_schema.py, which
occasionally led to test failures when the same OID was generated twice.
Using a different range, and making use of the expected RID if we have
it, should reduce the likelihood of collisions.

Signed-off-by: Joseph Sutton 
Reviewed-by: Douglas Bagnall 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Ralph Böhme 
Autobuild-Date(master): Thu Aug 25 13:55:47 UTC 2022 on sn-devel-184

schema_samba4.ldif: Allocate previously added OIDs

2022-08-25T12:59:29+00:00

DSDB_CONTROL_FORCE_ALLOW_VALIDATED_DNS_HOSTNAME_SPN_WRITE_OID was added
to source4/dsdb/samdb/samdb.h in commit
c2ab1f4696fa3f52918a126d0b37993a07f68bcb.

DSDB_EXTENDED_SCHEMA_LOAD was added in commit
1fd4cdfafaa6a41c824d1b3d76635bf3e446de0f.

Signed-off-by: Joseph Sutton 
Reviewed-by: Douglas Bagnall 
Reviewed-by: Stefan Metzmacher

s4:setup: Fix shellcheck errors in provision_fileperms.sh

2022-08-22T14:20:36+00:00

source4/setup/tests/provision_fileperms.sh:27:14: error: Iterating over
ls output is fragile. Use globs. [SC2045]

Signed-off-by: Andreas Schneider 
Reviewed-by: Pavel Filipenský

s4:setup: Reformat shell scripts

2022-07-15T12:08:36+00:00

shfmt -f source4/setup/ | xargs shfmt -w -p -i 0 -fn

Signed-off-by: Andreas Schneider 
Reviewed-by: Pavel Filipenský

s4/dlz: add support for bind 9.18

2022-05-23T00:53:09+00:00

It seems nothing has changed since 9.16 for our purposes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14986

Signed-off-by: Douglas Bagnall 
Signed-off-by: Andreas Hasenack 
Pair-programmed-with: Andreas Hasenack 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Mon May 23 00:53:09 UTC 2022 on sn-devel-184

s4:provision_users.ldif: Add Protected Users group

2022-03-18T11:55:30+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

CVE-2020-25722 blackbox/upgrades tests: ignore SPN for ldapcmp

2021-11-09T19:45:33+00:00

We need to have the SPNs there before someone else nabs them, which
makes the re-provisioned old releases different from the reference
versions that we keep for this comparison.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

CVE-2020-25722 s4/provision: add host/ SPNs at the start

2021-11-09T19:45:33+00:00

There are two reasons for this. Firstly, leaving SPNs unclaimed is
dangerous, as someone else could grab them first. Secondly, in some
circumstances (self join) we try to add a DNS/ SPN a little bit later
in provision. Under the rules we are introducing for CVE-2020-25722,
this will make our later attempts to add HOST/ fail.

This causes a few errors in samba4.blackbox.dbcheck.* tests, which
assert that revivified old domains match stored reference versions.
Now they don't, because they have servicePrincipalNames.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

CVE-2020-25722 tests: blackbox samba-tool spn non-admin test

2021-11-09T19:45:33+00:00

It is soon going to be impossible to add duplicate SPNs (short of
going behind DSDB's back on the local filesystem). Our test of adding
SPNs on non-admin users doubled as the test for adding a duplicate (using
--force). As --force is gone, we add these tests on Guest after the SPN
on Administrator is gone.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett