summaryrefslogtreecommitdiff
path: root/python/samba/tests/dcerpc
AgeCommit message (Collapse)AuthorFilesLines
2021-11-09CVE-2021-23192: python/tests/dcerpc: add tests to check how security ↵Stefan Metzmacher1-0/+1273
contexts relate to fragmented requests BUG: https://bugzilla.samba.org/show_bug.cgi?id=14875 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2021-11-09CVE-2021-23192: python/tests/dcerpc: fix do_single_request(send_req=False)Stefan Metzmacher1-17/+20
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14875 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2021-11-09CVE-2021-23192: python/tests/dcerpc: let generate_request_auth() use ↵Stefan Metzmacher1-3/+3
g_auth_level in all places BUG: https://bugzilla.samba.org/show_bug.cgi?id=14875 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2021-11-09CVE-2021-23192: python/tests/dcerpc: change assertNotEquals() into ↵Stefan Metzmacher2-151/+151
assertNotEqual() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14875 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2021-09-05selftest: Add a test for LookupSids3 and LookupNames4 in pythonAndrew Bartlett1-0/+333
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14807 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-06-22pytest: dcerpc/dnsserver: fix tombstone testDouglas Bagnall1-12/+80
It worked accidentally, like all our tombstone tests. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall2-2/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-08pytest/dcerpc/dnsserver.py: use dnsserver.flag_from_stringDouglas Bagnall1-9/+6
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-04-08pytest/dcerpcdnsserver: use record_from_string helperDouglas Bagnall1-28/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-03-29pytest/dnsserver: extend record_type_int to all typesDouglas Bagnall1-17/+2
with improved diagnostics on bad arguments Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-29pytest/dns: use self.assertIn() and .assertNotIn()Douglas Bagnall1-5/+5
These give a more detailed message than assertTrue(x in y). They were new in Python 3.1, so we avoided them until recently. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2020-11-06selftest: add a test for the CreateTrustedDomainRelax wrapperIsaac Boukris1-0/+131
Originally copied from 'source4/scripting/devel/createtrust' (had to drop the TRUST_AUTH_TYPE_VERSION part though, as it fails against samba DC). Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-11-06selftest: add a test for py dce transport_encryptedIsaac Boukris1-1/+22
Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29python:tests: Add SAMR password change tests for fipsAndreas Schneider1-0/+188
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-02python2 reduction: Merge remaining compat code into commonDavid Mulder1-7/+1
The remaining compat code (get_string, get_bytes, cmp) are useful helper routines which we should simply merge into common (especially since there is some duplication here). Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Fri Oct 2 14:49:36 UTC 2020 on sn-devel-184
2020-08-19python:tests: Add test for SMB encrypted DCERPC connectionAndreas Schneider1-0/+82
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Aug 19 17:46:28 UTC 2020 on sn-devel-184
2020-08-19s3:client: Turn off smb signing for message opAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-08-19python:tests: Set smb ipc signing via the creds APIAndreas Schneider1-0/+4
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-08-19python:tests: Mark libsmb connection as an IPC connectionAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-08-11python compat: remove text_typeDouglas Bagnall2-3/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-08-11python compat: remove binary_typeDouglas Bagnall1-3/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-08-11python compat: remove integer_typesDouglas Bagnall1-2/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-03-27selftest: use 10.53.57.0/8 instead of 127.0.0.1/8Stefan Metzmacher1-1/+1
This makes our testing much more realistic and allows the removal of some knowfail entries. It also means the testing with network namespaces on Linux can use the same addresses as our socket wrapper testing. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-07pytests: heed assertEquals deprecation warning en-masseDouglas Bagnall12-933/+933
TestCase.assertEquals() is an alias for TestCase.assertEqual() and has been deprecated since Python 2.7. When we run our tests with in python developer mode (`PYTHONDEVMODE=1 make test`) we get 580 DeprecationWarnings about this. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2019-12-10CVE-2019-14861: Test to demonstrate the bugAndrew Bartlett1-0/+47
This test does not fail every time, but when it does it casues a segfault which takes out the rpc_server master process, as this hosts the dnsserver pipe. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-12-10CVE-2019-14861: s4-rpc/dnsserver: Confirm sort behaviour in ↵Andrew Bartlett1-0/+101
dcesrv_DnssrvEnumRecords The sort behaviour for child records is not correct in Samba so we add a flapping entry. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-10-09selftest: add end-to-end tests for mdssvc with a fake HTTP serverRalph Boehme1-0/+194
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Noel Power <noel.power@suse.com>
2019-08-30rpc samr: EnumDomainUsers perf improvementAaron Haslett1-23/+1
EnumDomainUsers currently takes too long, significantly slowing down calls to winbind's getpwent which is a core unix API. The time is taken up by a GUID lookup for every record in the cached result. The advantages of this approach are: 1. It meets the specified requirement that if a record yet to be returned by a search in progress (with a resume handle) is deleted or modified, the future returned results correctly reflect the new changes. 2. Memory footprint for a search in progress is only 16 bytes per record. But, those benefits are not worth the significant performance hit of the lookups, so this patch changes the function to run the search and cache the RIDs and names of all records matching the search when the request is made. This makes the memory footprint around 200 bytes per record or up to 2MB per concurrent search for a 100k user database. The speedup achieved by this change is around 50%, and in tandem with some winbindd improvements as part of the same task has achieved around 15x speedup for getpwent. The lost specification compliance is unlikely to cause a problem for any known usage of this RPC call. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-01tests/dcerpc/raw_protocol: Add more tests for DCERPC_AUTH_LEVEL_PACKETGünther Deschner1-0/+11
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Aug 1 16:59:02 UTC 2019 on sn-devel-184
2019-08-01tests/dcerpc/raw_protocol: split test_spnego_integrity_request into 2 partsStefan Metzmacher1-2/+6
This can be a generic test that can be used for more auth_levels. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-01tests/dcerpc/raw_protocol: split test_spnego_connect_request() into 2 partsStefan Metzmacher1-3/+7
This can be a generic test that can be used for more auth_levels. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-06-19CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in ↵Douglas Bagnall1-0/+26
DnssrvOperation2 We still want to return DOES_NOT_EXIST when request_filter is not 0. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-19CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in ↵Douglas Bagnall1-0/+25
DnssrvOperation We still want to return DOES_NOT_EXIST when request_filter is not 0. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-14s2 decrpc samr: Add tests for QueryDomainInfoGary Lockyer1-0/+55
Add tests for the number of domain users, groups and aliases returned by QueryDomainInfo. These tests revealed that the existing code was not checking the returned elements to ensure they were part of the domain. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-12py:dcerpc/raw_protocol: add tests to demonstrate how security context ↵Stefan Metzmacher1-0/+967
multiplexing works Important things are this: - It's not required to use the bind time feature negotiation in order to use it, it's only a hint for the client, but nothing is really negotiated, unlike the request multiplexing with the DCERPC_PFC_FLAG_CONC_MPX. - There's special handling related to AUTH_LEVEL_CONNECT and requests without auth trailer - An security context is identified by the unique tuple of auth_type, auth_level and auth_context_id (all together!), not just the auth_context_id. - There's a limit of 2049 explicit authentication contexts. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_testcase: add assertEqualsStrLower()Stefan Metzmacher1-0/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_protocol: demonstrate that \\pipe\lsarpc returns \\pipe\lsass ↵Stefan Metzmacher1-2/+4
as secondary_address BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_protocol: add test_assoc_group_fail3()Stefan Metzmacher1-0/+45
This demonstrates that assoc groups are only shared on the same transport (endpoint). BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_protocol: add test_assoc_group_ok2 to check assoc groups over ↵Stefan Metzmacher1-0/+31
ncacn_np BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_protocol: enable tests with the ↵Stefan Metzmacher1-9/+3
DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_protocol: consistently call self.recv_pdu(timeout=0.01) after ↵Stefan Metzmacher1-1/+3
auth3 When we don't expect a FAULT, we should wait a little bit to check there's no response to auth3 request. This reduces the raw_procol test from 45s down to 35s total runtime against Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_protocol: add tests for delayed header signing activationStefan Metzmacher1-0/+186
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12py:dcerpc/raw_testcase: add pfc_flags_2nd and use_auth3 options to ↵Stefan Metzmacher1-2/+17
do_generic_bind() This makes it more flexible and allows to write complex tests in an easier fashion. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-09s3:libsmb: Revert SMB Py bindings name back to libsmb_samba_internalTim Beale1-1/+1
In order to make it clear that the APIs in these Python bindings are unstable and should not be used by external consumers, this patch changes the name of the Python bindings back to libsmb_samba_internal. To make the Python code that uses these bindings (i.e. samba-tool, etc) look a little cleaner, we can just change the module name as we import it, e.g. from samba.samba3 import libsmb_samba_internal as libsmb Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jan 9 14:30:31 CET 2019 on sn-devel-144
2019-01-07s3:pylibsmb: Rename 'credentials' param to match s4Tim Beale1-1/+1
s4 just calls it 'creds'. Renaming it will make it easier to convert existing SMB connections over to use the new bindings. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-01-07s3:pylibsmb: Rename libsmb_samba_internal Py bindings to libsmbTim Beale1-3/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-01-07s3:pylibsmb: Make lp a mandatory param for the SMB connectionTim Beale1-1/+1
Currently establishing the SMB connection relies on having initialized the global source3 loadparm. This patch makes the lp param mandatory, so that you always have to pass the parameter in when establishing the SMB connection. It also makes the source3 API more consistent with the current source4 API, which will make it easier to replace the source4 version later. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-23py:dcerpc/raw_testcase: add helper functions for ncacn_np: SMB connection ↵Stefan Metzmacher1-10/+136
support BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-12-23py:dcerpc/raw_testcase: maintain self.secondary_addressStefan Metzmacher1-8/+10
This was it's easier to alter once add support for SMB connections. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-12-23py:dcerpc/raw_testcase: maintain self.max_{xmit,recv}_fragStefan Metzmacher1-4/+16
This was it's easier to alter once add support for SMB connections. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 12:50:47 +0000