summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2023-03-20tests/krb5: Test that RODC-issued device groups are regeneratedJoseph Sutton1-1/+75
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Test that RODC-issued claims are regeneratedJoseph Sutton1-0/+248
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Add tests for RODC-issued armor ticketsJoseph Sutton1-0/+44
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Add tests for constrained delegation with RODC-issued ticketsJoseph Sutton1-0/+43
This works as long as both tickets are issued by the same RODC. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Add remove_client_claims_tgt_from_rodc()Joseph Sutton1-14/+29
This method removes the PAC_CLIENT_CLAIMS_INFO buffer *and* makes it appear as if a ticket were issued by an RODC. Because that's more efficient than decrypting and modifying the ticket twice. View with 'git show -b'. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Let ticket_with_sids() create RODC-issued ticketsJoseph Sutton1-2/+7
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Add signed_by_rodc()Joseph Sutton1-0/+12
This can be used to modify a service ticket to appear as if it were signed by an RODC krbtgt. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Move issued_by_rodc() to base classJoseph Sutton2-13/+13
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Fix additional_details account creation cachingJoseph Sutton1-45/+51
In Python, maps are not hashable and hence cannot be used as cache keys. To get around this, we were converting the account details map to a tuple of (key, value) pairs with the following expression: ((k, v) for k, v in details.items()) However, this was actually creating a lazily-evaluated generator object. The hash of this object was based on its address in memory, not on its contents, which meant that account options with the same details could have different hash values if the generators occupied different memory addresses, or (less likely) that account options with different details could hash to the same value if the second generator happened to inhabit the same memory address as the first one. The result was that account caching didn't work as intended. Attempt to fix that by using a frozenset instead of a generator object, and making sure that all our values are tuples (and thus hashable). Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Add simple resource-based constrained delegation testJoseph Sutton1-0/+11
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Only add AES enctype bits at domain functional level 2008 and aboveJoseph Sutton1-6/+15
At lower levels we should not expect these bits to be present. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Cache drsuapi connectionJoseph Sutton4-20/+26
We call get_keys() a lot, and it's more efficient if we aren't creating a new connection for every new account we create. To allow us to maintain a single cached connection, remove the samdb parameter from get_keys() and get_secrets(). No-one was using it anyway. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20tests/krb5: Generate full ticket signatures with trailing RODC idJoseph Sutton1-1/+1
This matches the use of make_rodc_zeroed_checksum() in the preceeding loop, and means that RODC-signed service tickets no longer fail to decrypt. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-20python:ndr: Use f-string to format exception messageJoseph Sutton1-1/+1
If 'object' happened to be a tuple, we would get one of the following errors: TypeError: not enough arguments for format string TypeError: not all arguments converted during string formatting Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-14python:netcmd: Decode return value of find_netbios() from bytes into stringAndreas Schneider1-1/+1
ERROR(<class 'TypeError'>): uncaught exception - replace() argument 1 must be str, not bytes File "bin/python/samba/netcmd/__init__.py", line 230, in _run return self.run(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "bin/python/samba/netcmd/ldapcmp.py", line 966, in run if b1.diff(b2): ^^^^^^^^^^^ File "bin/python/samba/netcmd/ldapcmp.py", line 790, in diff if object1 == object2: ^^^^^^^^^^^^^^^^^^ File "bin/python/samba/netcmd/ldapcmp.py", line 557, in __eq__ return self.cmp_attrs(other) ^^^^^^^^^^^^^^^^^^^^^ File "bin/python/samba/netcmd/ldapcmp.py", line 656, in cmp_attrs p = [self.fix_domain_netbios(j) for j in m] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "bin/python/samba/netcmd/ldapcmp.py", line 656, in <listcomp> p = [self.fix_domain_netbios(j) for j in m] ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "bin/python/samba/netcmd/ldapcmp.py", line 542, in fix_domain_netbios res = res.replace(self.con.domain_netbios.lower(), self.con.domain_netbios.upper()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ BUGS: https://bugzilla.samba.org/show_bug.cgi?id=15330 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-14dsdb: Avoid ERROR(ldb): uncaught exception - Deleted target CN=NTDS ↵Andrew Bartlett1-0/+19
Settings... in join "samba-tool domain join" uses the replication API in a strange way, perhaps no longer required, except that we often still have folks upgrading from very old Samba versions. When deferring the writing out to the DB of link replication to the very end, there is a greater opportunity for the deletion of an object to have been sent with the other objects, and have the link applied later. This tells the repl_meta_data code to behave as if GET_TGT had been sent at the time the link was returned, allowing a link to a deleted object to be silently discarded. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15329 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-03-09samba-tool: Ensure modifying GPO increments GPT.INI versDavid Mulder1-0/+63
When we modify a GPO, we must increment the version number in the GPT.INI, otherwise client machines won't process the update. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15327 Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-03-09samba-tool: Test that modifying GPO increments GPT.INI versDavid Mulder1-0/+95
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15327 Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-03-09samba-tool: Subclass GPOCommand for calling samdb_connectDavid Mulder1-15/+15
These sub commands will need to call samdb_connect in an upcoming commit. Subclass from GPOCommand to make this possible. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15327 Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-03-08tests/krb5: Remove old device info and device claims testsJoseph Sutton1-191/+0
They have been made superfluous by newer declarative tests in claims_tests.py and device_tests.py. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Add tests for device claimsJoseph Sutton1-2/+396
These test the interaction between claims and groups in the PAC. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Add tests for device infoJoseph Sutton2-0/+2046
These tests verify that the groups in the device info structure in the PAC are exactly as expected under various scenarios. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Overhaul check_device_info()Joseph Sutton1-24/+89
With expected_device_groups, tests can now specify particular group arrangements they expect to see. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Allow creating a target server account with or without compound ↵Joseph Sutton1-1/+9
ID support Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Don't specify extra enctypes for the krbtgtJoseph Sutton2-2/+13
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Allow adding members to a group and changing its type in a ↵Joseph Sutton1-4/+10
single operation This is needed in order to get some specific group setups for tests. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Add test for compressed claimJoseph Sutton1-0/+19
Create a claim large enough to cause it to be compressed. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Test we get correct values for integer syntax claimsJoseph Sutton1-5/+21
Windows erroneously shifts integer syntax claim values four bytes to the right, resulting in incorrect values (if only one claim is present) or corrupt claims data that cannot be unpacked (if other claims are present). There's no reason to emulate such broken behaviour. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Require domain_sid to be non-None when passing a RID to map_to_sid()Joseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Allow group_setup to be None in setup_groups()Joseph Sutton1-36/+39
'git show -b' shows that not much actually changes. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Test more descriptive security descriptorJoseph Sutton1-5/+7
This one has more flags set, so we can test whether we're getting our string representation right. Samba prints the flags in a different order from Windows, but fixing that now would be too risky and involve far too much churn for minimal benefit. (Consider how many tests verify security descriptors against string constants...) Instead, allow one of two possible security descriptors. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Document and tidy up existing claims testsJoseph Sutton1-24/+33
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Allow creating accounts supporting claims or compound identity ↵Joseph Sutton3-6/+21
separately Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Make arguments to get_target() keyword argumentsJoseph Sutton2-3/+5
This avoids mistakes by ensuring that passed-in arguments go to their intended destinations. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Split out device info checking into new methodJoseph Sutton1-45/+49
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Move some claims tests aroundJoseph Sutton1-80/+80
It's helpful to have the test declarations be together for better locality and ease of reading. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Add type to expect a value is one of a set of possible typesJoseph Sutton1-0/+36
This is useful for cases where we differ from Windows in some minor detail, and where the effort required to reach parity is unjustifiably high. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Allow comparing UnorderedLists only with one anotherJoseph Sutton1-5/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Unconditionally check compressed claimsJoseph Sutton1-13/+12
not only if STRICT_CHECKING=1. This also fixes a bug where the call to huffman_decompress() was indented incorrectly. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Remove unused importJoseph Sutton1-1/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03samba-tool: Clarify cse register command file destDavid Mulder1-2/+6
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03python/schema: Fix conversion to UTF-8 stringJoseph Sutton1-1/+1
str(b'foo') yields "b'foo'", which is wrong. Fix this to get "foo" instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03python/samba/common: Fix typosJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03samba-tool: Don't use invalid escape sequencesJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03gp: Don't use invalid escape sequencesJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03gp: Avoid shadowing importJoseph Sutton1-7/+7
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03python/samba: Avoid resource leakJoseph Sutton1-3/+3
View with 'git show -b'. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Add tests adding a user to a group prior to a TGS-REQJoseph Sutton1-0/+115
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-18 11:19:26 +0000