summaryrefslogtreecommitdiff
path: root/python/samba/tests/auth_log.py
AgeCommit message (Collapse)AuthorFilesLines
2025-01-13python:tests: let auth_log.py also test --option=clientusekrb5netlogon=yesStefan Metzmacher1-0/+97
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-01-13python:tests: let auth_log.py explicitly use --option=clientusekrb5netlogon=noStefan Metzmacher1-12/+99
It also add some additional checks to make sure netlogon with AES was used. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-01-13python:tests: let auth_log.py use self.assertIn(received, [4, 5]Stefan Metzmacher1-22/+11
This will simplify further changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2023-11-30python: tests: update all super calls to python 3 style in testsRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> [abartlet@samba.org Some python2 style super() calls remain due to being an actual, even if reasonable, behaviour change]
2023-11-30python: get rid of pointless empty overridden methodsRob van der Linde1-3/+0
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-14tests/auth_log: Properly expect authentication failuresJoseph Sutton1-8/+12
These authentications are actually failing (due to RESPONSE_TOO_BIG errors), but our authentication logging infrastructure hides this. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-14tests/auth_log: Make samba.tests.auth_log test executableJoseph Sutton1-0/+11
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-05CVE-2023-0922 set default ldap client sasl wrapping to sealRob van der Linde1-1/+1
This avoids sending new or reset passwords in the clear (integrity protected only) from samba-tool in particular. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15315 Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Apr 5 03:08:51 UTC 2023 on atb-devel-224
2022-10-21python: Fix invalid escape by using a raw stringJoseph Sutton1-1/+1
These escapes are meant for the regular expression engine not the string parser. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-01-26pytest:auth_log: expect TLS connections when using ldapsDouglas Bagnall1-4/+4
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-01-19tests/auth_log: adjust expected authDescription for test_smb_bad_userStefan Metzmacher1-1/+1
With NO_SUCH_USER we don't know if any pre-authentication was requested, so with the new Heimdal code we now used use "AS-REQ" instead of assuming ENC-TS Pre-authentication. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall1-1/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-07pytests: heed assertEquals deprecation warning en-masseDouglas Bagnall1-175/+175
TestCase.assertEquals() is an alias for TestCase.assertEqual() and has been deprecated since Python 2.7. When we run our tests with in python developer mode (`PYTHONDEVMODE=1 make test`) we get 580 DeprecationWarnings about this. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2019-10-03rpcclient: Remove unused global domain sidVolker Lendecke1-11/+11
For the auth_log tests using rpcclient this means one message less Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Oct 3 17:59:13 UTC 2019 on sn-devel-184
2019-01-17tests: Switchover auth_log from s4 SMB client bindings to s4Tim Beale1-10/+23
The main changes required are: - we need to use an s3 loadparm instead of the standard s4 lp. - the s3 SMB bindings don't support the use_spnego/ntlmv2_auth params, however, we can set these in the loadparm instead, which will get the SMB client code to do what we want. Instead of passing in boolean parameters, we need to use yes/no strings that the lp will accept. (We always set these values because the underlying lp context is actually global, and setting a value is 'sticky' and will persist across test cases. These conf settings are only used by the SMB client code, and so will only affect the SMB test cases). - For the no_spnego_no_ntlmv2 test cases, we now explicitly force it to an SMBv1 connection. The s4 bindings only ever supported SMBv1 connections, so this is the same behaviour. The other test cases will now try to negotiate SMBv2 connections, however, the no_ntlmv2 test cases are explicitly checking for bare-NTLM (with the s3 bindings, it now ends up as NTLMSSP by default). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Jan 17 04:47:56 CET 2019 on sn-devel-144
2019-01-17tests: Refactor auth_log SMB connection to be in a single placeTim Beale1-42/+20
This should not alter the behaviour of the tests at all. It just makes it easier to switch over the underlying SMB client bindings. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17tests: Use MUST_USE_KERBEROS over AUTO_USE_KERBEROS in auth_log testsTim Beale1-0/+2
The s3 SMB client bindings seem slightly different to s4, in that they default to setting the CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS flag. This seems to fallback to finding a valid KRB TGT (from a previous successful test), which results in the connection succeeding rather than failing. Setting MUST_USE_KERBEROS explicitly avoids this behaviour. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17tests: Relax auth_log SMB assertions to cover v1 *or* v2Tim Beale1-6/+6
The s4 Python bindings currently only support SMBv1 connections. If we change the bindings to support *either* v1 or v2, they'll end up negotiating v2. In which case the server is "SMB2", not "SMB", and these assertions fail. Long-term we want to get rid of SMBv1, so it makes sense to write the tests so that they pass against either v1 or v2. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-12-20tests (audit_auth)_log: PEP8 cleanup.Gary Lockyer1-32/+33
Remove Flake8 warnings from the audit and authentication JSON log tests. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-14auth log: Add windows logon type codesGary Lockyer1-20/+99
Add a new "logonType" element to the Authorisation JSON log messages. This contains a Windows Logon Type, the supported logon types are: 2 Interactive 3 Network 8 NetworkCleartext Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-14auth log: Add windows event codesGary Lockyer1-19/+102
Add a new "eventId" element to the Authorisation JSON log messages. This contains a Windows Event Code Id either: 4624 Successful logon 4625 Unsuccessful logon Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10PY3: wrap filter calls with list where list is expectedNoel Power1-1/+1
filter in PY2 returns list in PY3 it returns an iterator Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-24PEP8: fix E241: multiple spaces after ','Joe Guo1-2/+2
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E128: continuation line under-indented for visual indentJoe Guo1-5/+5
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-07-24tests/auth_log: Permit SMB2 service description if empty binding is used for ↵Alexander Bokovoy1-8/+18
kerberos authentication BUG: https://bugzilla.samba.org/show_bug.cgi?id=13308 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-06-25auth: For NTLM and KDC authentication, log the authentication durationAndrew Bartlett1-0/+3
This is not a general purpose profiling solution, but these JSON logs are already being generated and stored, so this is worth adding. Some administrators are very keen to know how long authentication takes, particularly due to long replication transactions in other processes. This complements a similar patch set to log the transaction duration. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-05-10auth logging tests: Clean up flake8 warningsGary Lockyer1-241/+230
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-05-10auth logging tests: Add tests for sessionIdGary Lockyer1-0/+5
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-03-23samba python tests: convert print func to be py2/py3 compatibleNoel Power1-2/+2
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-07-24tests auth_log: Modify existing tests to handle NETLOGON messagesGary Lockyer1-0/+11
Modify the existing tests to ignore auth logging for NETLOGON messages. NETLOGON authentication is logged once per session, and is tested separately. Ignoring it in these tests avoids order dependencies. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12865 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2017-06-22python/tests: test SMB1 and SMB2/3 in auth_log.pyStefan Metzmacher1-2/+47
We should do this explicitly in order to make the tests independent of 'client max protocol'. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-06-15selftest: Pass the dcerpc binding object to self.waitForMessages in auth_logAndrew Bartlett1-7/+7
This ensures that object is not cleaned up, triggering a disconnect before we get back the audit messages. Otherwise they can be lost when the server task calls exit() while the message thread is still trying to send them. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-03-29whitespace: auth_log.py python conventionsGarming Sam1-96/+92
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
2017-03-29auth log: Add tests for anonymous bind and SamLogonGary Lockyer1-0/+382
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-03-29ldap_server: Log failures to find a valid user in the simple bindGary Lockyer1-0/+80
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2017-03-29auth_log: Add tests by listening for JSON messages over the message busAndrew Bartlett1-0/+801
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Pair-programmed-by: Gary Lockyer <gary@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 23:07:38 +0000