summaryrefslogtreecommitdiff
path: root/python/samba/netcmd
AgeCommit message (Collapse)AuthorFilesLines
2023-01-17samba-tool domain: fix a typo in samba-tool passwordsettings option descriptionBjörn Baumbach1-1/+1
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-12-13CVE-2022-37966 samba-tool: add 'domain trust modify' commandStefan Metzmacher1-0/+121
For now it only allows the admin to modify the msDS-SupportedEncryptionTypes values. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-13CVE-2022-37966 samba-tool: Declare explicitly RC4 support of trust objectsJoseph Sutton1-2/+5
As we will assume, as part of the fixes for CVE-2022-37966, that trust objects with no msDS-SupportedEncryptionTypes attribute support AES keys, RC4 support must now be explicitly indicated. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 samba-tool: Fix 'domain trust create' documentationJoseph Sutton1-1/+1
This option does the opposite of what the documentation claims. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-11-21gp: PAM Access should implicitly deny ALL w/ allowDavid Mulder1-1/+2
If an allow entry is specified, the PAM Access CSE should implicitly deny ALL (everyone other than the explicit allow entries). Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-21gp: samba-tool manage gpo access add don't fail w/out upnDavid Mulder1-5/+3
The search response for the user could possibly not include a upn (this happens with Administrator for example). Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-21gp: Make samba-tool gpo manage sudoers remove backward compatibleDavid Mulder1-18/+46
Ensure `samba-tool gpo manage sudoers remove` is backward compatible with the GPME sudo rules. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-21gp: Make samba-tool gpo manage sudoers list backward compatibleDavid Mulder1-18/+42
Ensure `samba-tool gpo manage sudoers list` is backward compatible with the GPME sudo rules. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-15gp: Fix startup scripts add not always set runonceDavid Mulder1-1/+1
The runonce is always being set because neither True nor False is ever None. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Nov 15 02:09:45 UTC 2022 on sn-devel-184
2022-11-15gp: Fix startup scripts list not fail with empty argsDavid Mulder1-1/+5
This fixes the startup scripts list command to not fail when the parameters variable is empty. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-15gp: startup scripts list enclude newline in outputDavid Mulder1-1/+1
The output for listing startup scripts wasn't clear because there was no newline between entries. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-15gp: startup scripts add clarify 'args' optionDavid Mulder1-1/+1
Make sure it is clear how to specify args for the command, and that multiple args can be passed wrapped in quotes. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-15gp: Fix startup scripts add argsDavid Mulder1-1/+1
The args for the command could not be parsed because samba-tool detects the '-' and thinks its part of the samba-tool command. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-10-21samba-tool: Fix double-word in samba-tool domain passwordsettingsJoseph Sutton1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14034 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-05python: Handle LdbError thrown from functions operating on DNsJoseph Sutton1-5/+13
None of these functions can return False now. Instead we must catch the LdbError if we want to perform further error handling. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-10-04CVE-2007-4559 python: ensure sanity in our tarfilesDouglas Bagnall1-1/+1
Python's tarfile module is not very careful about paths that step out of the target directory. We can be a bit better at little cost. This was reported in 2007[1], and has recently been publicised [2, for example]. We were informed of this bug in December 2021 by Luis Alberto López Alvar, but decided then that there were no circumstances under which this was a security concern. That is, if you can alter the backup files, you can already do worse things. But there is a case to guard against an administrator being tricked into trying to restore a file that isn't based on a real backup. [1] https://nvd.nist.gov/vuln/detail/CVE-2007-4559 [2] https://www.theregister.com/2022/09/22/python_vulnerability_tarfile/ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15185 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Oct 4 03:48:43 UTC 2022 on sn-devel-184
2022-09-27samba-tool dsacl: Create common superclass for dsacl commandsChristian Merten1-49/+20
Created a base class for dsacl commands providing print_acl and some fixed command line options to reduce code duplication. Signed-off-by: Christian Merten <christian@merten.dev> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-09-27samba-tool dsacl: Create helper functions to remove code duplicationChristian Merten1-75/+43
Make multiple methods of dsacl command classes separate helper functions to avoid code duplication. Signed-off-by: Christian Merten <christian@merten.dev> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-09-27samba-tool dsacl: Add subcommand to delete ACEsChristian Merten1-0/+80
A new subcommand has been added to samba-tool dsacl to delete one or multiple ACEs from the security descriptor of an object. Signed-off-by: Christian Merten <christian@merten.dev> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-09-19samba-tool dbcheck: use colour if wantedDouglas Bagnall1-1/+8
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool: no stack trace on missing ldb tdbDouglas Bagnall1-0/+4
Now, in a testenv, if you forget to use '-s st/ad_dc/etc/smb.conf', you only see this: $ bin/samba-tool user rename dsadsa ldb: Unable to open tdb '$HERE/st/client/private/secrets.ldb': No such file or directory ldb: Failed to connect to '$HERE/st/client/private/secrets.ldb' with backend 'tdb': Unable to open tdb '$HERE/st/client/private/secrets.ldb': No such file or directory Could not find machine account in secrets database: Failed to fetch machine account password from secrets.ldb: Could not open secrets.ldb and failed to open $HERE/st/client/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO ltdb: tdb($HERE/st/client/private/sam.ldb): tdb_open_ex: could not open file $HERE/st/client/private/sam.ldb: No such file or directory Unable to open tdb '$HERE/st/client/private/sam.ldb': No such file or directory Failed to connect to 'tdb://$HERE/st/client/private/sam.ldb' with backend 'tdb': Unable to open tdb '$HERE/st/client/private/sam.ldb': No such file or directory ERROR(ldb): uncaught exception - Unable to open tdb '$HERE/st/client/private/sam.ldb': No such file or directory rather than all that AND a stack trace. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool: write ERROR in red if colour is wantedDouglas Bagnall1-6/+15
Often we'll write something like ERROR: Unable to find user "potato" which can get lost in the jumble of other output. With this patch, we colour the word "ERROR" red but not the rest of the string, unless it is determined that colour is not wanted (due to one of --color=never, NO_COLOR=1, output is not a tty). We choose to redden the word "ERROR" only to maintain legibility in the actual message, while hopefully increasing the noticeability of the line. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool visualize: simplify --color-scheme calculationsDouglas Bagnall1-19/+17
If you ask for a --color-scheme, you are implicitly asking for --color. That was documented in --help, but not followed here. Now --color=no --color-scheme=ansi will use colour for the graph, but not for other output. This might be useful when the graph is going to a different place than everything else (`-o foo.txt > bar.txt`). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool visualise: use global --colorDouglas Bagnall1-16/+9
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool: --color=auto looks at stderr and stdoutDouglas Bagnall1-1/+3
More often than not we are using colour in stderr, but are deciding based on stdout's tty-ness. This patch changes to use both, and will affect the following situation: samba-tool 2>/tmp/errors # used to be colour, now not. of course, if you want colour, you can always samba-tool --color=yes 2>/tmp/errors Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool drs showrepl: use global --color optionDouglas Bagnall1-5/+1
This changes the default from --color=no to --color=auto. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool: save --color choice for subcommandsDouglas Bagnall1-0/+2
In particular, visualize needs it to decide colour for an output file that may or may not be stdout, so it needs to make its own decision for that file. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool: make --color a general optionDouglas Bagnall3-0/+12
We don't put --color into options.SambaOptions because we can't handle the 'auto' case in the options module without knowing whether or not self.outf is a tty, and a) this might not be resolved and b) is fiddly to pass through. The .use_colour class flag allows samba-tool subcommands to avoid having --color, and is *also* useful in the short term for visualise and drs commands to avoid having this --color clobber their own bespoke versions (temporarily, during the transition). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16samba-tool: simplify and clarify SuperCommand._run() a littleDouglas Bagnall1-2/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08pytest/samba-tool: entry function follows too logicDouglas Bagnall1-2/+9
To further align the logic of the tool and the tests, we use the same logic in the test function as in samba-tool. In effect, this means the function is even less likely to raise an exception, rahter printing it out and returning an error code. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08samba-tool: add a convenience function that does it allDouglas Bagnall1-0/+7
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08samba-tool: _resolve() can set outf, errfDouglas Bagnall1-6/+12
We catch output in outf and errf for testing, which we currently do with cmd.outf = self.stringIO() cmd.errf = self.stringIO() on the final resolved commands. But this does not catch the output of the super-commands, of which we normally expect none. Using supercmd._resolve(*args, outf=self.stringIO(), errf=self.stringIO()) will redirect output all the way up the chain. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08samba-tool: more conventional usage of parser.parse_argsDouglas Bagnall1-3/+2
By default parse_args will use sys.argv[1:], which is to say the command-line without the command name. We have always fed it the equivalent of sys.argv, then trimmed the command off the result. That was a bit silly. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08samba-tool: separate ._run() from command resolutionDouglas Bagnall1-32/+55
Prior to this commit, in super-commands, the first half of the _run() is resolving what sub-command to run, and the second half is working out what to print if that failed. Some issues with that are: * it looks a little bit complicated. * the tests can't use the tool's resolution code, because it runs immediately, while the tests first want to fiddle with self.outf and so on. * it makes it harder to subclass and override the resolution code, so instead we do strange things like where we subclass dict as in main.py. So we split it into ._resolve() and ._run(). There are a few tests that break. We mark these as flapping, rather than knownfail, so as to avoid going into extremely fine-grain filters for tests that will be fixed within a few commits. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08samba-tool: do not crash on unimplemented .run()Douglas Bagnall1-2/+2
The run() method is always called with arguments, so it crashes before the NotImplementedError() is ever reached. That's OK, but this is better. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-07samba-tool ntacl: better messages for missing filesDouglas Bagnall1-8/+18
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14937 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Sep 7 06:02:20 UTC 2022 on sn-devel-184
2022-09-06samba-tool domain: use string_to_level helper()Douglas Bagnall1-21/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Sep 6 22:07:23 UTC 2022 on sn-devel-184
2022-09-06samba-tool domain: add string_to_level() helperDouglas Bagnall1-0/+8
Reverse transform of level_to_string(), obviously. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool domain: expand string_version_to_constant rangeDouglas Bagnall1-0/+4
This won't actually have any effect yet -- the new values are inaccessible in the place it is used because the range is limited by the --function-level option config. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool domain show: report level 2016Douglas Bagnall1-1/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool domain show: use level_to_string()Douglas Bagnall1-46/+4
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool domain: helper function for domain level namesDouglas Bagnall1-0/+17
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool ldapcmp: use CommandError on auth failureDouglas Bagnall1-2/+7
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool ldapcmp: use CommandError, not assertionDouglas Bagnall1-1/+4
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool ldapcmp: do not assume common attributesDouglas Bagnall1-1/+1
This has caused numerous reports of ERROR(<class 'KeyError'>): uncaught exception - 'serverReferenceBL' File /usr/lib/python3/dist-packages/samba/netcmd/__init__.py, line 185, in _run return self.run(*args, **kwargs) File /usr/lib/python3/dist-packages/samba/netcmd/ldapcmp.py, line 957, in run if b1.diff(b2): File /usr/lib/python3/dist-packages/samba/netcmd/ldapcmp.py, line 781, in diff if object1 == object2: File /usr/lib/python3/dist-packages/samba/netcmd/ldapcmp.py, line 549, in __eq__ return self.cmp_attrs(other) File /usr/lib/python3/dist-packages/samba/netcmd/ldapcmp.py, line 590, in cmp_attrs if isinstance(self.attributes[x], list) and isinstance(other.attributes[x], list): because other does not have attribute 'x'. It is better to assume other.attributes[x] is None, which will compare as unequal to whatever self.attributes[x] is, showing up as a diff rather than a crash. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool ldapcmp: use shorter names in cmp_attrsDouglas Bagnall1-15/+19
This simplifies a fix in the next commit. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool ldapcmp: use ValueError, not ExceptionDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool dns: catch werror.WERR_ACCESS_DENIEDDouglas Bagnall1-0/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool dns: use DnsconnWrapper in zonecreateDouglas Bagnall1-8/+8
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-06samba-tool dns: update_record uses DnsConnWrapperDouglas Bagnall1-15/+16
The special thing about this one is the dns_conn is also used in the dns_record_match() library function, which wants a real dns connection. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 05:18:09 +0000