summaryrefslogtreecommitdiff
path: root/python/samba/tests
AgeCommit message (Collapse)AuthorFilesLines
2026-04-16pytests: dns_packet tests check rcodes match WindowsDouglas Bagnall1-27/+148
the dns_packet tests originally checked only for a particular DoS situation (CVE-2020-10745) but now we widen them to ensure Samba's replies to invalid packets resembles those of Windows (in particular, Windows 2012r2). We want Samba to reply only when Windows replies, and with the same rcode. At present we fail a lot of these tests. The original CVE-2020-10745 test is retained and widened indirectly -- any test that leaves the server unable to respond within 0.5 seconds will count as a failure. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14378 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2026-04-01s4/dns_server: add large dns udp truncated packets testsAndréas Leroux1-0/+123
Large DNS response must be truncated over UDP, though this is not yet done in samba. Test is added as knownfail until implementation BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988 Signed-off-by: Andréas Leroux <aleroux@tranquil.it> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-03-30tests:krb5 expired password handlingGary Lockyer1-2/+1
The windows ADDC checks password validity before password expiry. So an incorrect expired password will return KDC_ERR_PREAUTH_REQUIRED not KDC_ERR_KEY_EXPIRED. The KDC behaviour fixes will be made to lorikeet-heimdal and then imported to samba. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15746 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2026-03-30python:tests/krb5: Make PADATA_PK_AS_REP optional in non-strict modeAndreas Schneider1-0/+1
Commit c1433f821f7 added PADATA_PK_AS_REP (PA-PK-AS-REP, type 17) to the expected padata list when check_rep_padata sees KDC_ERR_KEY_EXPIRED. This reflects Samba's Heimdal KDC behaviour, which includes PKINIT hints in expired-password error responses. Samba with MIT KDC does not include PADATA_PK_AS_REP in KDC_ERR_KEY_EXPIRED responses; it returns a METHOD-DATA with just the NTSTATUS payload (type 3) and the FX-COOKIE (type 133). This causes test_pw_expired to fail intermittently when the expired-password code path is exercised against MIT KDC. Add PADATA_PK_AS_REP to the require_strict set alongside PADATA_PK_AS_REP_19, so it is treated as optional in non-strict checking mode (STRICT_CHECKING=0) while still being enforced in strict mode. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Mar 30 10:41:07 UTC 2026 on atb-devel-224
2026-03-30python:tests: Fix assertEqual placement in test_device_group_restrictionsAndreas Schneider1-5/+4
The assertEqual calls checking the exception attributes were incorrectly indented inside the 'with self.assertRaises()' block. When the expected NTSTATUSError is raised by verify_access(), execution exits the block immediately, so those lines were never reached. When the exception is not raised (e.g. with MIT KRB5 1.22 where a spurious FAST error was fixed), execution falls through to the assertEqual inside the block, causing AttributeError because error.exception is only available after the 'with' block exits. The exception returned is NT_STATUS_UNSUCCESSFUL with Heimdal. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2026-02-23test:heimdal:pkinit fixes for SHA1-PUKEY calculationGary Lockyer1-2/+2
The SHA1 hash for KB5014754 SHA1-PUKEY is calculate over the entire certificate not just the public key. BUG https://bugzilla.samba.org/show_bug.cgi?id=16001 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2026-02-23s4:kdc:db-glue altSecurityIdentities DN and serial reversedGary Lockyer1-23/+39
When altSecurityIdentities is set by RSAT / ADUC they store the Issuer and Subject DN in last to first order i.e. CN=Common Name, O=Organization, C=Country Need to reverse that to first to last order, i.e. C=Country, O=Organization, CN=Common name Which is how they're stored on the X509 certificates. Also the serial number is stored in reverse order. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16001 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2026-02-18CVE-2026-20833: s4:kdc: Make default domain supported enctypes AES by defaultJennifer Sutton2-16/+20
If AES keys are available in the domain, assume that service accounts support AES by default. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15998 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2026-02-18CVE-2026-20833: python:tests: Set secure channel type for test credentialsJennifer Sutton1-0/+2
This will ensure that we use the correct salting algorithm for AES when we authenticate using gensec. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15998 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2026-01-21lib:ldb-samba:ildap: fix empty attribute list handlingGary Lockyer1-1/+1
An LDB request interprets an empty attribute list as a request for no attributes, but LDAP interprets an empty list as a request for all attributes, and ["1.1"] as a request for no attributes, as per RFC4511:4.5.1.8(SearchRequest.attributes). We need to convert [] to ["1.1"] in the ildap module before the request goes out. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13852 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Jan 21 03:29:23 UTC 2026 on atb-devel-224
2026-01-15pytest:krb5:as_req: adjust for 'require canonicalization'Douglas Bagnall1-10/+62
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15pytest:krb5:ms_kile: adjust for 'require canonicalization'Douglas Bagnall1-0/+66
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15pytest:krb5: as_canonicalization recognises require canon optionDouglas Bagnall1-0/+7
If the test is run against a require canonicalization = yes server, requests that do not use the canonicalize flag will be rejected at the preauth stage, so we check that and nothing more. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15pytest:krb5: notice require canonicalization optionDouglas Bagnall1-0/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15pytest:krb5 as_canonicalization checks no implicit $ return codeDouglas Bagnall1-0/+15
We check here instead of selftest/expectedfail.d/* in part because on MIT some of these cases will fail to fail to ask for preauth. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15kdc: match implicit dollar without canon affects AS_REQ client onlyDouglas Bagnall1-8/+1
The smb.conf option kdc name match implicit dollar without canonicalization = no is supposed to avoid the dollar ticket attack by refusing to consider "foo$" as a match for "foo" unless canonicalization is requested. This was rather blunt however, as the only time we care about this is for the client name in an AS_REQ, and we can easily check whether that is the case. This makes the option less intrusive, allowing the use of "SERVER" for a server name rather than "SERVER$". A number of tests no longer fail. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15pytest:krb5:as_canonicalization debug formattingDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15samba-tool gpo: remove unused importDouglas Bagnall1-1/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-15dsdb:password_hash: reject password reset with UNWILLING_TO_PERFORMDouglas Bagnall1-1/+1
This is what Windows does: where a password change would cause CONSTRAINT_VIOLATION, a reset causes UNWILLING_TO_PERFORM. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12020 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-12-09python:tests: Fix ProcessPoolExecutor with Python 3.14Andreas Schneider2-7/+25
REASON: Exception: Exception: Traceback (most recent call last): File "/home/asn/workspace/prj/oss/samba/asn-fix/bin/python/samba/tests/krb5/lockout_tests.py", line 858, in test_lockout_transaction_bad_pwd_samr_aes self.do_lockout_transaction(connect_samr_aes, correct_pw=False) ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/asn/workspace/prj/oss/samba/asn-fix/bin/python/samba/tests/krb5/lockout_tests.py", line 990, in do_lockout_transaction connect_future = executor.submit( connect_fn, ...<7 lines>... workstation=user_creds.get_workstation(), dn=str(user_dn)) File "/usr/lib64/python3.14/concurrent/futures/process.py", line 816, in submit self._adjust_process_count() ~~~~~~~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib64/python3.14/concurrent/futures/process.py", line 775, in _adjust_process_count self._spawn_process() ~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib64/python3.14/concurrent/futures/process.py", line 793, in _spawn_process p.start() ~~~~~~~^^ File "/usr/lib64/python3.14/multiprocessing/process.py", line 121, in start self._popen = self._Popen(self) ~~~~~~~~~~~^^^^^^ File "/usr/lib64/python3.14/multiprocessing/context.py", line 300, in _Popen return Popen(process_obj) File "/usr/lib64/python3.14/multiprocessing/popen_forkserver.py", line 35, in __init__ super().__init__(process_obj) ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ File "/usr/lib64/python3.14/multiprocessing/popen_fork.py", line 20, in __init__ self._launch(process_obj) ~~~~~~~~~~~~^^^^^^^^^^^^^ File "/usr/lib64/python3.14/multiprocessing/popen_forkserver.py", line 42, in _launch prep_data = spawn.get_preparation_data(process_obj._name) File "/usr/lib64/python3.14/multiprocessing/spawn.py", line 164, in get_preparation_data _check_not_importing_main() ~~~~~~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib64/python3.14/multiprocessing/spawn.py", line 140, in _check_not_importing_main raise RuntimeError(''' ...<16 lines>... ''') RuntimeError: An attempt has been made to start a new process before the current process has finished its bootstrapping phase. This probably means that you are not using fork to start your child processes and you have forgotten to use the proper idiom in the main module: if __name__ == '__main__': freeze_support() ... The "freeze_support()" line can be omitted if the program is not going to be frozen to produce an executable. To fix this issue, refer to the "Safe importing of main module" section in https://docs.python.org/3/library/multiprocessing.html In Python 3.14, the default multiprocessing start method changed from fork to forkserver/spawn. When using ProcessPoolExecutor, the code needs to either: 1. Explicitly set the start method to fork (the simplest fix for this case) 2. Or ensure proper if __name__ == '__main__': guards (not practical for test code run by a test framework) The fix is to explicitly use the fork start method when creating the ProcessPoolExecutor. This can be done by passing a mp_context parameter: Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-11-20pytests: krb5 raw tests use TestCase.get_server_param()Douglas Bagnall1-10/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytest: krb5 alias tests: expect no machine$ match on ad_dc_ntvfsDouglas Bagnall1-1/+9
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytest:krb5: ms-kile-client tests notice lack of dollar matchingDouglas Bagnall1-0/+34
In the ad_dc_ntvfs environment. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytest: krb5 tests remember implicit dollar optionDouglas Bagnall1-0/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytests: add TestCase.get_server_param() methodDouglas Bagnall1-0/+16
This makes it easier to get a loadparm value from the server smb.conf (rather than the client smb.conf), so you can alter test behaviour accordingly. The class._server_lp attribute is lazily loaded when first needed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytest:krb5: print error names on errorDouglas Bagnall1-5/+11
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytest:krb5: errcode errors include namesDouglas Bagnall2-1/+6
Before: > AssertionError: 6 not found in (20,) After: > AssertionError: 6 not found in (20,) : KDC_ERR_C_PRINCIPAL_UNKNOWN not in ['KDC_ERR_TGT_REVOKED'] Useful for people who don't know the codes off by heart. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytests: rename KRB_ERR_TKT_NYV as KDC_ERR_TKT_NYVDouglas Bagnall2-6/+6
to be consistent with all the others. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-20pytest: test auth.user_session with principalsDouglas Bagnall1-1/+45
This tests authsam_get_session_info_principal() which tests sam_get_results_principal() which tests crack_user_principal_name(). sam_get_results_principal() is also used in samba_kdc_lookup_client(), and we are sort of testing on behalf of that. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-19tests/krb5: Construct signed_attrs correctlyJennifer Sutton4-33/+117
signed_attrs is supposed to be a list of key‐value pairs, but we forgot the values. Because the field was not constructed correctly, the pyasn1 encoder simply stripped it out. Also properly separate the signature algorithm and digest algorithms. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Nov 19 00:32:31 UTC 2025 on atb-devel-224
2025-11-18tests/krb5: Add TD_CMS_DIGEST_ALGORITHMS constantJennifer Sutton4-1/+19
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-11-18python:tests: Correct test class nameJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-11-14python:tests: Take INTERDOMAIN_TRUST into accountAndreas Schneider1-6/+16
If we run e.g. fl2008rc2 env before we run this test, we have a trust account for this domain. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Nov 14 19:23:38 UTC 2025 on atb-devel-224
2025-11-14python:tests: Add debug output to test_query_filter_enum()Andreas Schneider1-5/+36
This test runs relatively late in 'make test'. It finds some accounts which are neither a computer nor a user account and complains that the overall account count doesn't match. Add some debug so we can find out more about the accounts. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-11-14python:tests: Use random users for domain_auth_silo.pyAndreas Schneider1-18/+46
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-11-14python:tests: Use random users for user_auth_silo.pyAndreas Schneider1-22/+89
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-11-14python:tests: Use random users for user_auth_policy.pyAndreas Schneider1-25/+90
We should not work on alice, bob and joe. We should use random user so we can clean up afterwards. If we don't do this the dbcheck tests will fails with: UNEXPECTED(failure): samba4.blackbox.dbcheck(ad_dc).dbcheck(ad_dc:local) REASON: Exception: Exception: Checking 21449 objects WARNING: target DN is deleted for msDS-AssignedAuthNPolicy in object CN=alice,CN=Users,DC=addom,DC=samba,DC=example,DC=com - <GUID=66bd1f51-084f-4259-a769-efa59adb6e31>;<RMD_ADDTIM E=134051822550000000>;<RMD_CHANGETIME=134051822550000000>;<RMD_FLAGS=1>;<RMD_INVOCID=b5064b02-c91e-40c0-bc1f-a92a0105a810>;<RMD_LOCAL_USN=14061>;<RMD_ORIGINATING_USN=14061>;<RMD_VE RSION=2>;CN=User Policy,CN=AuthN Policies,CN=AuthN Policy Configuration,CN=Services,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com Target GUID points at deleted DN 'CN=User Policy\\0ADEL:66bd1f51-084f-4259-a769-efa59adb6e31,CN=Deleted Objects,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com' Not removing WARNING: target DN is deleted for msDS-AssignedAuthNPolicySilo in object CN=alice,CN=Users,DC=addom,DC=samba,DC=example,DC=com - <GUID=287d6c3d-bea8-4c06-bdf8-7d4b579bc0e9>;<RMD_AD DTIME=134051822560000000>;<RMD_CHANGETIME=134051822560000000>;<RMD_FLAGS=1>;<RMD_INVOCID=b5064b02-c91e-40c0-bc1f-a92a0105a810>;<RMD_LOCAL_USN=14081>;<RMD_ORIGINATING_USN=14081>;<RM D_VERSION=2>;CN=Developers,CN=AuthN Silos,CN=AuthN Policy Configuration,CN=Services,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com Target GUID points at deleted DN 'CN=Developers\\0ADEL:287d6c3d-bea8-4c06-bdf8-7d4b579bc0e9,CN=Deleted Objects,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com' Not removing WARNING: target DN is deleted for msDS-AssignedAuthNPolicy in object CN=bob,CN=Users,DC=addom,DC=samba,DC=example,DC=com - <GUID=66bd1f51-084f-4259-a769-efa59adb6e31>;<RMD_ADDTIME= 134051822550000000>;<RMD_CHANGETIME=134051822550000000>;<RMD_FLAGS=1>;<RMD_INVOCID=b5064b02-c91e-40c0-bc1f-a92a0105a810>;<RMD_LOCAL_USN=14065>;<RMD_ORIGINATING_USN=14065>;<RMD_VERS ION=4>;CN=User Policy,CN=AuthN Policies,CN=AuthN Policy Configuration,CN=Services,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com Target GUID points at deleted DN 'CN=User Policy\\0ADEL:66bd1f51-084f-4259-a769-efa59adb6e31,CN=Deleted Objects,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com' Not removing WARNING: target DN is deleted for msDS-AssignedAuthNPolicySilo in object CN=bob,CN=Users,DC=addom,DC=samba,DC=example,DC=com - <GUID=1a1e5cdf-b92e-4a80-bc35-cccad8e9f865>;<RMD_ADDT IME=134051822560000000>;<RMD_CHANGETIME=134051822560000000>;<RMD_FLAGS=1>;<RMD_INVOCID=b5064b02-c91e-40c0-bc1f-a92a0105a810>;<RMD_LOCAL_USN=14085>;<RMD_ORIGINATING_USN=14085>;<RMD_ VERSION=4>;CN=QA,CN=AuthN Silos,CN=AuthN Policy Configuration,CN=Services,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com Target GUID points at deleted DN 'CN=QA\\0ADEL:1a1e5cdf-b92e-4a80-bc35-cccad8e9f865,CN=Deleted Objects,CN=Configuration,DC=addom,DC=samba,DC=example,DC=com' Not removing Checked 21449 objects (4 errors) Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-11-13s4:kdc:tests: support "kdc always generate pac"Gary Lockyer3-12/+49
Update the tests to check the "kdc always generate pac" configuration and expect the presence of a PAC accordingly. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-11-05samba-tool: Add subcommand to generate Certificate Signing Requests with SID ↵Jennifer Sutton1-0/+154
extension Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-11-05python: Factor out asn.1 methods into their own moduleJennifer Sutton3-79/+14
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-11-05python:tests: Fix code spellingJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22tests/krb5: Add tests for the Object SID certificate security extensionJennifer Sutton1-36/+100
View with ‘git show -b’. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22tests/krb5: Remove unused importsJennifer Sutton1-3/+0
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-22tests/krb5: Remove unused methodJennifer Sutton1-133/+0
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-21CVE-2025-10230: s4/tests: check that wins hook sanitizes namesDouglas Bagnall1-0/+2
An smb.conf can contain a 'wins hook' parameter, which names a script to run when a WINS name is changed. The man page says The second argument is the NetBIOS name. If the name is not a legal name then the wins hook is not called. Legal names contain only letters, digits, hyphens, underscores and periods. but it turns out the legality check is not performed if the WINS server in question is the source4 nbt one. It is not expected that people will run this server, but they can. This is bad because the name is passed unescaped into a shell command line, allowing command injection. For this test we don't care whether the WINS server is returning an error code, just whether it is running the wins hook. The tests show it often runs the hook it shouldn't, though some characters are incidentally blocked because the name has to fit in a DN before it gets to the hook, and DNs have a few syntactic restrictions (e.g., blocking '<', '>', and ';'). The source3 WINS server that is used by Samba when not run as a DC is not affected and not here tested. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15903 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-10mdssvc: implement elasticsearch:default_fieldsRalph Boehme2-4/+8
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15927 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-10-10mdssvc: fix filtering by share path prefixRalph Boehme2-8/+60
To correctly filter by share path, use a filter with a prefix match. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15927 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-10-10tests:s4:kdc Add tests for pkinit certificate mappingGary Lockyer3-1/+1172
Tests for pkinit with "strong certificate binding enforcement" See: https://support.microsoft.com/en-us/topic/ kb5014754-certificate-based-authentication-changes-on-windows-domain -controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 KB5014754: Certificate-based authentication changes on Windows domain controllers Test environment configuration: ad_dc none ad_dc_ntcfs compatibility ad_dc_smb1 full Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-10-10s4:dsdb:audit_log change action for auth infoGary Lockyer1-9/+9
Change the action logged for authentication information changes from "Public key change" to "Auth info change". To reflect that it's not just changes to public keys that get logged. This doesn't require a JSON log format version change, because the version was recently bumped in c9e752ab18f43758d704951f7f31e39dafa6fdb4 and there hasn't been a Samba release in the meantime. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-10-10tests:audit_log_pass_change add tests for auth info loggingGary Lockyer1-2/+66
Add tests for the logging of changes to altSecurityIdentities, dnsHostName, servicePrincipalName and msDS-AdditionalDnsHostNames Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 19:12:47 +0000