summaryrefslogtreecommitdiff
path: root/python/samba/tests
AgeCommit message (Collapse)AuthorFilesLines
2025-08-27tests/krb5: Remove redundant lineJennifer Sutton1-2/+0
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-26pytest: safe_tarfile: accept NotADirectoryError as bad path rejectionDouglas Bagnall1-1/+2
After recent upstream Python fixes for various path escape and symlink CVEs in tarfile, in particular this commit: commit 3612d8f51741b11f36f8fb0494d79086bac9390a Author: Łukasz Langa <lukasz@langa.pl> Date: Tue Jun 3 12:42:11 2025 +0200 gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` (#135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. Signed-off-by: Łukasz Langa <lukasz@langa.pl> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> our ../../ test that looks for a tarfile.OutsideDestinationError now meets a NotADirectoryError in recent Python versions (this from 3.13, Fedora 42): UNEXPECTED(error): samba.tests.safe_tarfile.samba.tests.safe_tarfile.SafeTarFileTestCase.test_dots(none) REASON: Exception: Exception: Traceback (most recent call last): File "/tmp/samba-testbase/b1/samba-o3/bin/python/samba/tests/safe_tarfile.py", line 48, in test_dots self.assertRaises(tarfile.OutsideDestinationError, ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ stf.extractall, ^^^^^^^^^^^^^^^ tarname) ^^^^^^^^ File "/usr/lib64/python3.13/unittest/case.py", line 795, in assertRaises return context.handle('assertRaises', args, kwargs) ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/unittest/case.py", line 238, in handle callable_obj(*args, **kwargs) ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/tarfile.py", line 2343, in extractall tarinfo, unfiltered = self._get_extract_tarinfo( ~~~~~~~~~~~~~~~~~~~~~~~~~^ member, filter_function, path) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/tarfile.py", line 2432, in _get_extract_tarinfo self._handle_fatal_error(e) ~~~~~~~~~~~~~~~~~~~~~~~~^^^ File "/usr/lib64/python3.13/tarfile.py", line 2430, in _get_extract_tarinfo filtered = filter_function(unfiltered, path) File "/usr/lib64/python3.13/tarfile.py", line 842, in tar_filter new_attrs = _get_filtered_attrs(member, dest_path, False) File "/usr/lib64/python3.13/tarfile.py", line 783, in _get_filtered_attrs target_path = os.path.realpath(os.path.join(dest_path, name), strict=os.path.ALLOW_MISSING) File "<frozen posixpath>", line 457, in realpath NotADirectoryError: [Errno 20] Not a directory: '/tmp/samba-testbase/b1/samba-o3/bin/ab/tmp/tmpbn6e69ci/tar.tar' In this commit, we say that a NotADirectoryError is OK. When we started safe_tarfile we were acting in advance of upstream Python, but now they are well ahead of us. If we trust their work in recent versions and accept the error conditions they choose, we can more easily get rid of our safe_tarfile when the time is right. For the moment we still support as far back as Python 3.6 for some old enterprise distros, and it is for those that we continue to maintain safe_tarfile. In versions before 3.11 we will see tarfile.ExtractError, and the test for that is unaffected by this change. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-25auth:creds: Make sure to uppercase the realm of a principalAndreas Schneider1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15893 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-08-20pytest:samba-tool group: remove unused importsDouglas Bagnall1-5/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Aug 20 05:35:03 UTC 2025 on atb-devel-224
2025-08-20pytest: run user_keytrust tests as computer keytrust testsDouglas Bagnall1-0/+16
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20pytest: adapt user_keytrust tests to be objectclass agnosticDouglas Bagnall1-89/+95
We will reuse the tests for the computer keytrust command. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add user keytrust commandDouglas Bagnall1-0/+360
This allows manipulation of key credential links for users. See `man -l bin/default/docs-xml/manpages/samba-tool.8` for documentation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:tests: test key_credential_link moduleDouglas Bagnall1-0/+307
These tests use the samba.key_credential_link module and a real samdb. The existing key_credential_link tests address the IDL generated structures more directly. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-15CI: add Python test samba.tests.dcerpc.dfs.DfsTests.test_dfs_reparse_tagRalph Boehme1-0/+48
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15843 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-15python/tests: also populate self.server in calls LibsmbTests setup()Ralph Boehme1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15843 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-07pytest: add key_credential_link_Dn testsDouglas Bagnall1-0/+83
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:krb5_base: use BinaryDn not dsdb_dnDouglas Bagnall1-4/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:dsdb_dn: expand and rework testsDouglas Bagnall1-29/+77
We now test the specialised StringDn and BinaryDn types. There are new assertions about case-insensitivity in binary hex strings and BinaryDn prefix validation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:dsdb_dn: fix binary testDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py/common: add cmp_with_nones() helper functionDouglas Bagnall1-1/+15
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytests: test normalise_int32 against out-of-range numbersDouglas Bagnall1-0/+3
For example, we don't want to "normalise" 0x9876543210 to 0x9776543210, or 0x200000000 to 0x100000000. That is just causing random damage to 64 bit values without achieving the sign switch. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytests: move dsdb_dn tests out of commonDouglas Bagnall2-36/+59
dsdb_Dn hasn't been in samba.common since 85d2ff2f0003b106ca84866b7e7893723f1dd93c and the tests should follow. Although dsdb_Dn is currently in samba.samdb, we aren't moving the tests to samba.tests.samdb, because those tests need a real AD environment whereas these ones can run more cheaply in the "none" environment. Another patch will improve the remaining samba.common tests. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-05auth:creds: Make sure when parsing username that realm is uppercaseAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-07-31librpc:bcrypt_rsakey_blob: exponent and modulus lengths can't be zeroDouglas Bagnall1-28/+23
Apart from it making no sense, without these ranges we end up allocating a NULL buffer and aborting. We also put a maximum size on the RSA key, in case we could get tricked into a DoS by pulling a large buffer and trying crypto maths on it. 6 0x572ebce2749a in talloc_abort samba/lib/talloc/talloc.c:506:3 7 0x572ebce271d4 in talloc_chunk_from_ptr samba/lib/talloc/talloc.c:0 8 0x572ebce271d4 in __talloc_with_prefix samba/lib/talloc/talloc.c:762:12 9 0x572ebce235f9 in __talloc samba/lib/talloc/talloc.c:825:9 10 0x572ebce235f9 in _talloc_named_const samba/lib/talloc/talloc.c:982:8 11 0x572ebce235f9 in _talloc_memdup samba/lib/talloc/talloc.c:2441:9 12 0x572ebc8f6a4f in data_blob_talloc_named samba/lib/util/data_blob.c:56:25 13 0x572ebc7d23bd in pull_BCRYPT_RSAPUBLIC_BLOB samba/librpc/ndr/ndr_keycredlink.c:878:17 14 0x572ebc7d23bd in ndr_pull_KeyMaterialInternal samba/librpc/ndr/ndr_keycredlink.c:959:10 15 0x572ebc788e90 in LLVMFuzzerTestOneInput samba/bin/default/lib/fuzzing/fuzz_ndr_keycredlink_TYPE_STRUCT.c:282:13 REF: https://issues.oss-fuzz.com/issues/435039896 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Jul 31 05:45:07 UTC 2025 on atb-devel-224
2025-07-29librpc: keycredlink support X509 public keysGary Lockyer1-0/+232
Add support for X509 encoded public keys in msDSKeyCredentialLink KeyMaterial. Note: Only RSA public keys are supported. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-29librpc/idl: Add idl for tpm20_rsakey_blobGary Lockyer1-0/+130
Idl and tests for TPM20_RSAKEY_BLOB, one of the possible encoding of msDSKeyCredentialLink KeyMaterial Derived from: https://dox.ipxe.org/Tpm20_8h_source.html#l00164 https://stackoverflow.com/questions/78958315/cannot-parse-tpm2-0-public-key Note: this is a greatly simplified implementation that only handles TPM version 2, RSA public keys. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-29librpc/idl: Add idl for BCRYPT_RSAKEY_BLOBGary Lockyer1-0/+221
Idl and tests for BCRYPT_RSAKEY_BLOB See https://learn.microsoft.com/en-us/windows/win32/api/ bcrypt/ns-bcrypt-bcrypt_rsakey_blob This is one of the encodings of msDSKeyCredentialLink KeyMaterial when KeyUsage is KEY_USAGE_NGC. As there appears to be no official documentation on the contents of KeyMaterial have based this on. https://github.com/p0dalirius/pydsinternals/blob/271dd969e07a8939044bfc498d94443082ec6fa9/ dsinternals/common/data/hello/KeyCredential.py#L75-L92 Note: only RSA public keys are handled Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-10tests: Rename local variable: prefix_abs -> prefixPavel Filipenský1-2/+2
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jul 10 16:15:24 UTC 2025 on atb-devel-224
2025-07-10tests: Replace PREFIX_ABS with PREFIXPavel Filipenský2-2/+2
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-07-07tests: expand SMB3 POSIX test for Windows illegal characters behaviourRalph Boehme1-2/+19
The test was testing file creation, but not FIND behaviour. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15862 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2025-06-24python:tests/nss: Add NSS group enumeration testSamuel Cabrero2-0/+131
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-06-19librpc/idl: Add idl for msDS-KeyCredentialLinkGary Lockyer1-0/+555
Idl and supporting helpers for msDS-KeyCredentialLinks. See [MS-ADTS] 2.2.20 Key Credential Link Structures Currently the KeyMaterial is treated as a binary blob The naming and casing of the variable names is close as is possible to those in the specification. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Jun 19 00:08:31 UTC 2025 on atb-devel-224
2025-06-16pytest: samba-tool group: test with 16 character nameDouglas Bagnall1-1/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15854 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Björn Baumbach <bb@samba.org>
2025-06-16pytest:samba-tool group: test addmembersDouglas Bagnall1-0/+14
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15854 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Björn Baumbach <bb@samba.org>
2025-06-05samba-tool tests: test dns --allow-existingDouglas Bagnall1-0/+13
This will fail until the next commit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13613 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org>
2025-06-05tests/samba-tool: optionally allow exception to be a failure in .run*()Douglas Bagnall1-7/+20
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13613 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org>
2025-06-05pytests: samba_dnsupdate --use-samba-tool versus existing recordsDouglas Bagnall1-0/+13
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13613 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org>
2025-05-26samba-tool: Fix invalid escape sequencesJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Jo Sutton <jsutton@samba.org> Autobuild-Date(master): Mon May 26 03:44:44 UTC 2025 on atb-devel-224
2025-05-26tests/krb5: Correct commentJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python:tests: Permit expected_count to be zeroJennifer Sutton1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python:tests: Decode stdout for greater readabilityJennifer Sutton1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python:tests: Decode stdout and stderr for greater readabilityJennifer Sutton1-1/+9
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python:tests: Test that secret keys and confidential attributes are not ↵Jennifer Sutton1-6/+136
included in a --no-secrets backup BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-04-18docs-xml/smbdotconf: change 'smb ports' into a synonym for 'server smb ↵Stefan Metzmacher1-3/+1
transport' Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-04-03python:tests/krb5: let _{get,modify}_tgt() also change the objectsid in ↵Stefan Metzmacher1-0/+13
UPN_DNS_INFO Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: allow set_pac_sids() to take upn_dns_sidStefan Metzmacher1-2/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: let check_device_info() allow an empty rid arrayStefan Metzmacher1-1/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: allow create_account_opts() to take ↵Stefan Metzmacher1-0/+27
selective_auth_allowed_sid This will add a GUID_DRS_ALLOWED_TO_AUTHENTICATE ace with CONTROL_ACCESS to the created account. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: allow tgs_exchange_dict() to take ↵Stefan Metzmacher1-0/+42
expected_[device_]duplicated_groups This allows us to expect duplicated sids in the PAC. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: let check_device_info() handle EXTRA_DOMAIN_SIDStefan Metzmacher1-8/+21
device info does not really have RESOURCE_SID, so we need to map RESOURCE_SID as well as EXTRA_SID (with a S-1-5-21- prefix) to EXTRA_DOMAIN_SID. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: create_account_opts() can't handle self.AccountType.TRUSTStefan Metzmacher1-0/+1
create_trust() is used for that... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03python:tests/krb5: add KDC_ERR_PATH_NOT_ACCEPTEDStefan Metzmacher1-0/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-03-29pytest: source_tree_topdir() checks more thoroughlyDouglas Bagnall1-8/+12
We are more certain of how many ../ steps we are from top than we are that the existence of a thing called 'source4' is a definite sign that this is a full source tree. So we check fewer depths and more subdirectories. This also modernises the return type to be a pathlib.Path, which works without change for current callers. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-03-29python: make source_tree_topdir() test-onlyDouglas Bagnall4-4/+15
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-03-25python:gp_cert_auto_enrol: fix GUID stringificationDouglas Bagnall1-2/+4
We were using some broken ad-hoc unpacking to do what the ndr unpacker does perfectly well. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15839 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Mar 25 05:21:49 UTC 2025 on atb-devel-224
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 06:21:29 +0000