samba.git/testprogs, branch master

CVE-2025-10230: s4/tests: check that wins hook sanitizes names

2025-10-21T18:40:37+00:00

An smb.conf can contain a 'wins hook' parameter, which names a script
to run when a WINS name is changed. The man page says

    The second argument is the NetBIOS name. If the name is not a
    legal name then the wins hook is not called. Legal names contain
    only letters, digits, hyphens, underscores and periods.

but it turns out the legality check is not performed if the WINS
server in question is the source4 nbt one. It is not expected that
people will run this server, but they can. This is bad because the
name is passed unescaped into a shell command line, allowing command
injection.

For this test we don't care whether the WINS server is returning an
error code, just whether it is running the wins hook. The tests show
it often runs the hook it shouldn't, though some characters are
incidentally blocked because the name has to fit in a DN before it
gets to the hook, and DNs have a few syntactic restrictions (e.g.,
blocking '<', '>', and ';').

The source3 WINS server that is used by Samba when not run as a DC is
not affected and not here tested.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15903

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

tests: Run `dd` without any preloaded libraries

2025-10-16T09:34:58+00:00

If AddressSanitizer is loaded it will detect alignment issues. The tool
is not ours, so ignore it.

Signed-off-by: Andreas Schneider 
Reviewed-by: Anoop C S 

Autobuild-User(master): Anoop C S 
Autobuild-Date(master): Thu Oct 16 09:34:58 UTC 2025 on atb-devel-224

tests: Add test for 'net ads join' to a preferred DC

2025-09-05T12:38:28+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905

Signed-off-by: Pavel Filipenský 
Reviewed-by: Alexander Bokovoy

schema: Add Validated-Write-Computer Extended Right from Windows Server 2016

2025-08-27T03:41:36+00:00

Signed-off-by: Jennifer Sutton 
Reviewed-by: Douglas Bagnall

tests: Replace PREFIX_ABS with PREFIX

2025-07-10T15:17:34+00:00

Signed-off-by: Pavel Filipenský 
Reviewed-by: Andreas Schneider

lib:cmdline: POPT_CALLBACK_REASON_POST should handle if we skip the password callback

2025-04-15T12:54:57+00:00

It is already checking if there is a valid ccache and disabling the callback.
In case of IAKerb we specify a ccache but might to fill one with a krbtgt.

Signed-off-by: Andreas Schneider 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Alexander Bokovoy 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Tue Apr 15 12:54:57 UTC 2025 on atb-devel-224

testprogs: Use 'sync machine password to keytab' for keytab creation

2025-04-11T08:38:49+00:00

We want to get rid of dedicatedkeytabfile for writing keytabs.

Signed-off-by: Andreas Schneider 
Reviewed-by: Pavel Filipenský 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Fri Apr 11 08:38:49 UTC 2025 on atb-devel-224

testprogs: Remove dead code

2025-04-11T07:35:49+00:00

The test for this has been removed already, this is just leftover.

Signed-off-by: Andreas Schneider 
Reviewed-by: Pavel Filipenský

s3:net: 'net ads keytab list' should only list default keytab

2025-04-11T07:35:49+00:00

If you don't specify a keytab, assume we just want the default keytab. This will
make upcoming changes to the code easier.

Signed-off-by: Andreas Schneider 
Reviewed-by: Pavel Filipenský

selfest: add test for non-local offlinejoin provision

2025-01-30T06:32:37+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15777

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider