summaryrefslogtreecommitdiff
path: root/python/samba/tests
AgeCommit message (Collapse)AuthorFilesLines
2023-01-10tests/krb5: Use Python bindings for LZ77+Huffman compressionJoseph Sutton2-132/+3
We can now remove our existing decompression implementation in Python. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Jan 10 21:18:01 UTC 2023 on sn-devel-184
2022-12-23python:tests: Use system ldbsearch if we built against system libldbAndreas Schneider1-6/+10
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-23python:tests: Use system ldbdump if we build with system ldbAndreas Schneider1-1/+5
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-23python:tests: Use system ldbsearch if we build with system libldbAndreas Schneider1-1/+4
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-22lib/compression: add simple python bindingsDouglas Bagnall1-0/+212
There are four functions, allowing compression and decompression in the two formats we support so far. The functions will accept bytes or unicode strings which are treated as utf-8. The LZ77+Huffman decompression algorithm requires an exact target length to decompress, so this is mandatory. The plain decompression algorithm does not need an exact length, but you can provide one to help it know how much space to allocate. As currently written, you can provide a short length and it will often succeed in decompressing to a different shorter string. These bindings are intended to make ad-hoc investigation easier, not for production use. This is reflected in the guesses about output size that plain_decompress() makes if you don't supply one -- either they are stupidly wasteful or ridiculously insufficient, depending on whether or not you were trying to decompress a 20MB string. >>> a = '12345678' >>> import compression >>> b = compression.huffman_compress(a) >>> b b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 #.... >>> len(b) 262 >>> c = compression.huffman_decompress(b, len(a)) >>> c b'12345678' # note, c is bytes, a is str >>> a '12345678' >>> d = compression.plain_compress(a) >>> d b'\xff\xff\xff\x0012345678' >>> compression.plain_decompress(d) # no size specified, guesses b'12345678' >>> compression.plain_decompress(d,5) b'12345' >>> compression.plain_decompress(d,0) # 0 for auto b'12345678' >>> compression.plain_decompress(d,1) b'1' >>> compression.plain_decompress(a,444) Traceback (most recent call last): compression.CompressionError: unable to decompress data into a buffer of 444 bytes. >>> compression.plain_decompress(b,444) b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 #... That last one decompresses the Huffman compressed file with the plain compressor; pretty much any string is valid for plain decompression. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21gp: Ensure rsop is tested for every CSEDavid Mulder1-4/+101
A bug cropped up in the rsop that was causing a crash because this wasn't being tested. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21gp: Enable gpupdate output when testingDavid Mulder1-0/+1
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21gp: Ensure policy changes don't leave files behindDavid Mulder1-3/+30
This test exercises the gp_file_applier and ensures that when a policy is modified, no old policy is left behind. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21gp: Test that files are re-created if manually removedDavid Mulder1-2/+12
Currently applied files which are manually removed do not get re-applied. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21gp: Modify Chromium CSE to use new files applierDavid Mulder1-2101/+17
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21gp: Modify Machine Scripts CSE to use new files applierDavid Mulder1-0/+1
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-20tests: add a Python test for case insensitive accessRalph Boehme1-0/+52
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Dec 20 01:32:07 UTC 2022 on sn-devel-184
2022-12-15tests: Show that in smb1 posix we don't treat dirs as case sensitiveVolker Lendecke1-0/+52
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-12-13CVE-2022-37966 python:/tests/krb5: call sys.path.insert(0, "bin/python") ↵Stefan Metzmacher22-73/+82
before any other imports This allows the tests to be executed without an explicit PYTHONPATH="bin/python". BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Dec 13 14:06:14 UTC 2022 on sn-devel-184
2022-12-13CVE-2022-37966 param: let "kdc default domain supportedenctypes = 0" mean ↵Stefan Metzmacher2-1/+7
the default In order to allow better upgrades we need the default value for smb.conf to the same even if the effective default value of the software changes in future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:tests/krb5: test much more etype combinationsStefan Metzmacher1-14/+139
This tests work out the difference between - msDS-SupportedEncryptionTypes value or it's default - software defined extra flags for DC accounts - accounts with only an nt hash being stored - the resulting value in the KRB5_PADATA_SUPPORTED_ETYPES announcement BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:tests/krb5: add better PADATA_SUPPORTED_ETYPES assert ↵Stefan Metzmacher1-2/+2
message BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:tests/krb5: add 'force_nt4_hash' for account creation ↵Stefan Metzmacher1-6/+32
of KDCBaseTest This will allow us to create tests accounts with only an nt4 hash stored, without any aes keys. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:tests/krb5: ignore empty supplementalCredentials ↵Stefan Metzmacher1-0/+2
attributes BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:tests/krb5: allow ticket/supported_etypes to be passed ↵Stefan Metzmacher1-3/+8
KdcTgsBaseTests._{as,tgs}_req() BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:tests/krb5: fix some tests running against Windows 2022Stefan Metzmacher3-7/+39
I'm using the following options: SERVER=172.31.9.218 DC_SERVER=w2022-118.w2022-l7.base \ SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 \ DOMAIN=W2022-L7 REALM=W2022-L7.BASE \ ADMIN_USERNAME=Administrator ADMIN_PASSWORD=A1b2C3d4 \ CLIENT_USERNAME=Administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=28 CLIENT_KVNO=2 \ FULL_SIG_SUPPORT=1 TKT_SIG_SUPPORT=1 FORCED_RC4=1 in order to run these: python/samba/tests/krb5/as_req_tests.py -v --failfast AsReqKerberosTests python/samba/tests/krb5/etype_tests.py -v --failfast EtypeTests BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 selftest: Run S4U tests against FL2003 DCJoseph Sutton1-4/+57
This shows that changes around RC4 encryption types do not break older functional levels where only RC4 keys are available. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 selftest: Add tests for Kerberos session key behaviour since ↵Joseph Sutton7-134/+429
ENC_HMAC_SHA1_96_AES256_SK was added ENC_HMAC_SHA1_96_AES256_SK is a flag introduced for by Microsoft in this CVE to indicate that additionally, AES session keys are available. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-13CVE-2022-37966 tests/krb5: Test different preauth etypes with Protected ↵Joseph Sutton1-9/+38
Users group Extend the RC4 Protected Users tests to use different preauth etypes. This helps test the nuances of the new expected behaviour and allows the tests to continue passing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37967 Add new PAC checksumJoseph Sutton6-17/+215
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15231 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-13CVE-2022-37966 tests/krb5: Add a test requesting tickets with various ↵Joseph Sutton3-0/+363
encryption types The KDC should leave the choice of ticket encryption type up to the target service, and admit no influence from the client. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 tests/krb5: Add 'etypes' parameter to _tgs_req()Joseph Sutton1-1/+3
This lets us select the encryption types we claim to support in the request body. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 tests/krb5: Split out _tgs_req() into base classJoseph Sutton1-131/+133
We will use it for testing our handling of encryption types. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 selftest: Allow krb5 tests to run against an IP by using the ↵Andrew Bartlett1-1/+2
target_hostname binding string This makes it easier to test against a server that is not accessible via DNS. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-06CVE-2022-44640 selftest: Exclude Heimdal fuzz-inputs from source_chars testAndrew Bartlett1-0/+1
A new file will shorlty fail as it is binary input BUG: https://bugzilla.samba.org/show_bug.cgi?id=14929 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-05tests: Test error codes for SET_REPARSE_POINTVolker Lendecke1-0/+21
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-05tests: Try setting a 0-sized reparse pointVolker Lendecke1-0/+7
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-05tests: Ignore symlink trusts flags in symlink error returnsVolker Lendecke1-1/+7
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-05tests: Fix use of self.assertRaises()Volker Lendecke2-24/+37
The with statement creates a new variable. I thought it opens a block where "e" is only valid in that block. But instead it runs the whole thing, expecting an exception somewhere. Learning python.... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-05tests: Show that we can write to a reparse point fileVolker Lendecke1-0/+28
Works against Windows 2016 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-05tests: Show that a directory with a reparse point can't be populatedVolker Lendecke1-3/+15
Works against Windows 2016 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-05tests: IO_REPARSE_TAG_NOT_HANDLED is acceptable for unlinkVolker Lendecke1-0/+1
This happens when a path has an unknown reparse point in the middle Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2022-12-01lib/compression: script to test 3 byte hashDouglas Bagnall1-0/+1
Compression uses a 3 byte hash remember LZ77 matches in a 14-bit table. This script runs the hash over all 16M combinations, then again over all ASCII combinations, counting collisions to find hot-spots. If you think you have a better hash, you are probably right, but you should try it here -- alter h() -- before committing to it. This one is literally the first one I thought of. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01test/source_chars: ignore testdata/compressionDouglas Bagnall1-0/+1
We are going to have all kinds of rubbish there. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-11-29s3: Test that store_smb2_posix_info hides info for '..'David Mulder1-1/+25
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-11-29tests/s3: Test file/dir permissions with SMB3 posixDavid Mulder1-0/+56
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-11-29tests/s3: Test case sensitive open with SMB3 posixDavid Mulder1-0/+37
Disabled because we don't handle posix paths correctly yet. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-11-29tests/s3: Test delete on close with SMB3 posixDavid Mulder1-0/+22
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-11-29tests/s3: Test reserved chars in posix filenameDavid Mulder1-0/+29
Disabled because we don't handle posix paths correctly yet. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-11-29tests/s3: Test SMB2_FIND_POSIX_INFORMATION dir queryDavid Mulder1-0/+48
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-11-22tests: Start testing smb2 symlink error returnsVolker Lendecke1-0/+166
This still all fails, but if you run them against Windows they work. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Nov 22 19:25:34 UTC 2022 on sn-devel-184
2022-11-22tests: Start testing reparsepointsVolker Lendecke1-0/+167
This still all fails, but if you run them against Windows they work. How to run: PYTHONPATH=bin/python \ LOCAL_PATH=/tmp \ SMB1_SHARE=share \ SMB2_SHARE=share \ SHARENAME=share \ SERVER_IP=<server-ip> \ DOMAIN=<your-domain> \ USERNAME=Administrator \ PASSWORD=<your-password> \ SMB_CONF_PATH=/usr/local/samba/etc/smb.conf \ SERVERCONFFILE="$SMB_CONF_PATH" \ python3 -m samba.subunit.run samba.tests.reparsepoints Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-22tests: Fix an incorrect commentVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-22libsmb: Add "DOMAIN" to authentication credsVolker Lendecke1-0/+1
If you want to create symlinks on Windows using reparse points, you need to authenticate as local administrator, just "administrator" is not enough. So this is required to run some tests against Windows. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-11-21gp: Test PAM Access with DENY_ALLDavid Mulder1-2/+5
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Nov 21 22:05:01 UTC 2022 on sn-devel-184
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 06:16:35 +0000