summaryrefslogtreecommitdiff
path: root/python/samba
AgeCommit message (Collapse)AuthorFilesLines
2024-04-16python:gkdi: Add Gkdi.from_key_envelope() methodJo Sutton1-0/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16python:gkdi: Add notes on GKDI time periodsJo Sutton1-0/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/gkdi: Change ‘current_gkid’ parameter to ‘current_time’Jo Sutton2-17/+22
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/gkdi: Remove implicit clock skew offsetJo Sutton1-4/+0
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/gkdi: Allow current time to be overriddenJo Sutton2-23/+43
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/krb5: Make use of ‘expect_edata’ parameterJo Sutton1-0/+3
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/krb5: Remove unused variableJo Sutton1-4/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/krb5: Fix code spellingJo Sutton1-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16tests/krb5: Remove unused importJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16python:tests: Fix typoJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16python:tests: Reformat codeJo Sutton1-7/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16python:tests: Fix set declarationJo Sutton1-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16python:tests: Replace deprecated method assertRaisesRegexp()Jo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16selftest: Move some KDS root key tests around to prepare for gMSA server sideAndrew Bartlett2-211/+256
Once we have a gMSA server side the impact of deleting root keys becomes real and so we must do this in a quiet place where it can not impact on other things. Likewise, we want the samba.tests.dsdb_quiet_provision_tests tests to run somewhere that is not doing other things, so we can see what a bare provision will do. We must not allow test ordering inside the file to cause tests that create root keys to run before checking if provision created a usable root key. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-04-10ldb: Add more segfault tests DN handlingAndrew Bartlett1-0/+40
- from_dict DN use-after-free - check for the same directly creating the ldb.Message Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-04-10python:upgrade/upgradeprovision: use dn.copy to align ldbsDouglas Bagnall2-5/+5
We need to do this when the dn is on a message from another ldb. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-10pytest:segfault: some more ldb crashesDouglas Bagnall1-0/+134
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-10samba-tool domain backup: Use new ldb.disconnect() method to force-close ↵Andrew Bartlett1-0/+2
files during backup Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-04-10selftest: Add tests that demonstrate the issues with ldb use after freeAndrew Bartlett1-0/+172
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-04-10pytest:krb5/lockout: associate user DN with the ldb it is used withDouglas Bagnall1-7/+6
LDB is soon going to object strongly to Python DNs that don't come from the ldb that they are being used with, for memory safety reasons. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09auth/credentials: Read managed_password.passwords.query_interval only after ↵Andrew Bartlett1-1/+1
parsing The code previously read the uninitialised stack not the parsed structure, and so could segfault if the stack was not zero. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Apr 9 23:59:54 UTC 2024 on atb-devel-224
2024-04-09python/samba/tests: Fix gMSA blackbox test to expect failure to get password ↵Andrew Bartlett1-4/+8
after membership change Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-04-09python: Use OpenPolicyFallback() in trust.pyAndreas Schneider1-28/+84
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python: Implement CreateTrustedDomainFallback()Andreas Schneider2-2/+180
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python: Add aead_aes_256_cbc_hmac_sha512()Andreas Schneider1-0/+11
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python: Use secrets.token_bytes instead of randomAndreas Schneider1-4/+2
random should not be used to create secure random numbers for tokens. The secrets module is exactly for this. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python: Set parameter types for CreateTrustedDomainRelax()Andreas Schneider1-2/+9
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python:tests: Clean lsa_utils.py code according to Python standardsAndreas Schneider1-12/+26
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python:tests: Rename createtrustrelax.py to lsa_utils.pyAndreas Schneider1-0/+0
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python: Implement OpenPolicyFallback()Andreas Schneider2-8/+60
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-09python:samba: Rename trust_utils.py to lsa_utils.pyAndreas Schneider3-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08netcmd: fix broken shell command missing ModelRob van der Linde1-1/+0
This is already in MODELS which is populated in ModelMeta Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Apr 8 04:07:22 UTC 2024 on atb-devel-224
2024-04-08python: lint: fix pylint R1720 unnecessary "raise" after "else"Rob van der Linde3-6/+6
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08python: lint: remove unused imports in claims and gmsa commandsRob van der Linde4-7/+4
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08python: tests: type check should always use "is" or "is not"Rob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08python: tests: fix closing quote in docstring exampleRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08selftest: Add new test for testing non-chunk transfer encodingNoel Power1-1/+14
And add a known fail because there is a bug :-( BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08selftest: fix potential reference before assigned errorNoel Power2-2/+2
This would only happen if the test failed (but the message would be incorrect as 'e' the exception to be stringified doesn't exist. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-08python:tests: Improve keytab comparison of dckeytabAndreas Schneider1-3/+20
This will give better output on failure as it compares strings instead of bytes. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28python/samba/tests/krb5: Extend PKINIT tests to cover UF_SMARTCARD_REQUIREDAndrew Bartlett1-1/+203
This in particular tests the returned NTLM password buffers as well as the password rotation on expired accounts described at https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/whats-new-in-credential-protection Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Mar 28 02:53:53 UTC 2024 on atb-devel-224
2024-03-28python/tests/krb5: Prepare to allow tests that use the PAC returned NT hashAndrew Bartlett2-2/+8
We want to use the PAC returned NT hash in the UF_SMARTCARD_REQUIRED case as it will usually be random bytes so we can not just assert on the value any more. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-28python/tests/krb5: Allow getting a TGT in pkinit testsAndrew Bartlett1-11/+25
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-28python/tests/krb5: Prepare for PKINIT tests with UF_SMARTCARD_REQUIREDAndrew Bartlett3-8/+42
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-28tests/krb5: Fix PK-INIT test framework to allow expired password keysJo Sutton2-0/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28python/samba/krb5: Allow client address (caddr) to be missing or emptyAndrew Bartlett1-3/+7
Currently (as of 2024-02) windows 21H2 returns this as []. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-28netcmd: auth policy: remove old service-allowed-to-authenticate-from-silo ↵Rob van der Linde2-123/+25
and group Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28netcmd: auth policy: add service-allowed-to-authenticate-from subcommandsRob van der Linde2-0/+128
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28netcmd: auth policy: remove old user-allowed-to-authenticate-from-silo and groupRob van der Linde3-114/+31
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28netcmd: auth policy: add user-allowed-to-authenticate-from subcommandsRob van der Linde2-0/+128
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28netcmd: auth policy: remove old service-allowed-to-authenticate-to-silo and ↵Rob van der Linde2-105/+25
group Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 06:55:23 +0000