summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2023-09-26libcli/security: Pass in claims evaluation state when building any security ↵Andrew Bartlett1-1/+1
token Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-09-26pytest: conditional_ace assembler assembles full descriptorDouglas Bagnall1-2/+33
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: beginning of tests for conditional ACE bytesDouglas Bagnall1-0/+98
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: assembler for conditional ACEsDouglas Bagnall1-0/+196
This is a helper module to construct conditional ACEs that can't be created from SDDL. There is a semi-infinite number of valid conditional ACEs that don't have SDDL representations, and an even larger number of invalid (or borderline invalid) ACEs. This allows us to create those ACEs without having to deal with too many array of numbers. The next commit provides an example of its use. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest:conditional_ace_claims: ease export of failing tests to CDouglas Bagnall1-0/+59
When a test fails, this prints a little stanza like static void test_something(void **state) { INIT(); USER_SIDS("WD", "AA"); DEVICE_SIDS("BA", "BG"); SD("D:(XA;;0x1f;;;AA;(! Member_of{SID(AA)}))"); DENY_CHECK(0x10); } which is exactly right for copying into libcli/security/tests/test_run_conditional_ace.c which is much easier to iterate over with compiling and debugging. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: tests for conditional ACEs with security tokensDouglas Bagnall1-0/+338
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: tools for creating security tokensDouglas Bagnall1-0/+239
Sometimes we need security tokens for tests, and the raw constructor is not very ergonomic. This wraps it so you can do this: from samba.tests.token_factory import token as Token t = Token(['WD', 'AA'], privileges=['SEC_PRIV_DEBUG'], rights=0x840, device_claims={'wheels': 2, 'smelly': 'no'}, device_sids=['BG']) and get a security.token object with the expected qualities. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: sddl tests with conditional ACEsDouglas Bagnall1-0/+52
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: sddl strings dir can be defined in classDouglas Bagnall1-9/+15
Before we had to do this in an environment variable. In that case we are probably wanting to monitor changes, so we like it to print more messages than we want to see in an autobuild run that will hopefully never do anything interesting. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: sddl tests can be only externally definedDouglas Bagnall1-0/+3
Currently a test suite needs a strings list in order to import new strings. This lets us avoid that and have the actual tests defined only in external lists, making it easier to see we're testing the same thing on Windows and reducing duplication. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest:security_descriptors: test collected conditional ACEsDouglas Bagnall1-1/+8
These tests were named in the superclass, but were not actually run, nor was the file in git. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest:security descriptors: hack to capture results as jsonDouglas Bagnall1-0/+29
This makes it easy to separate a large number of examples into successes and knownfails. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security descriptors: test some conditional and RA ACEsDouglas Bagnall1-0/+21
We have two sets of tests: one that will succeed, and one that is going to remain a knownfail. The latter involves Resource Attribute ACEs that have the TX type, meaning "byte string". In MS-DTYP, a bytestring is defined like "#6869210a", with a hash, followed by an even number of hex digits. In other places on the web, it is mentioned that zeroes in the string can be replaced by hashes, like so "#686921#a". We discover via indirect fuzzing that a TX RA ACE can also take bare integers, like "6869210a" or "2023". As it would be tricky to support this, and there is no evidence of this occurring in the wild, we will probably leave this as a knownfail. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security_descriptors: tests without revision number hackDouglas Bagnall1-0/+9
ACL revision 4 (SECURITY_ACL_REVISION_ADS) is effectively a superset of revision 2 (SECURITY_ACL_REVISION_NT4), so any revision 2 ACL can be called revision 4 without any problem. But not vice versa: a revision 4 ACL can contain ACE types that a revision 2 ACL can't. The extra ACE types relate to objects. Samba currently simplifies things by calling all its ACLs revision 4, even if (as is commonly the case) the ACLs contain only revision 2 ACEs. On the other hand, Windows will use revision 2 whenever it can. In other tests we skip past this by forcing Windows ACLs to v4 before comparison. This test is to remind us of the incompatibility. It would not be hard to fix. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security_descriptors test for repetitive ACLsDouglas Bagnall1-0/+12
If there are multiple identical ACEs in an SDDL ACL, Windows will decode them all and put extra trailing zeroes at the end of the ACL. In contrast, Samba will decode the ACEs and not put extra zeroes at the end. The problem comes when Samba tries to read a binary ACL from Windows that has the extra zeroes, because Samba's ACL size calculation is based on the size of its constituent ACEs, not the ACL size field. There is no good reason for an ACL to have repeated ACEs, but they could be added accidentally. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security_descriptors comparison is quieterDouglas Bagnall1-10/+2
This matters when we have a millions failures. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-21conf: Remove "smb3 unix extensions" parameterVolker Lendecke1-172/+81
Always offer it, it's a client thing to ask for it or not. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Sep 21 17:43:23 UTC 2023 on atb-devel-224
2023-09-20tests: Add reproducer for BZ15481Volker Lendecke1-0/+27
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15481 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-09-14tests/krb5: Rename ‘client_claims’ to ‘claims_metadata’Joseph Sutton1-8/+8
This variable is used not only for client claims, but for device claims as well. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14python:tests: Fix invalid escape sequenceJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14python:tests: Remove unused variablesJoseph Sutton2-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14claims.idl: Be more lenient in our expectations for the compression of claimsJoseph Sutton1-2/+4
384 bytes is not a strict threshold below which claims are never to be compressed. Windows has been known to compress claims a mere 368 bytes in size. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14python:tests: Remove unused importsJoseph Sutton6-10/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-11python:tests: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-08tests: Add test_symlink_reparse_data_buffer_parseVolker Lendecke1-0/+15
The blob was taken from a smbclient allinfo command for a Windows symlink. Show that reparse_data_buffer_parse() is broken. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-09-08tests: Create symlinks using posix extensionsVolker Lendecke1-1/+3
This way we can run the tests and more easily put them into knownfail individually. Before this, everything went into the error category, which was not so easy to catch in something like knownfail. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-09-07pytests:security: don't use invalid domain SID S-2-0-0Douglas Bagnall1-13/+17
The '2' is a version number, but there is not yet a version 2, so we can't even say what the rest of the string should look like. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Have modified_ticket() not modify its argumentsJoseph Sutton1-0/+4
Inexplicable behaviour could result when the same arguments were passed in across multiple calls. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Add KerberosCredentials.get_rid()Joseph Sutton1-0/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Re-raise any LdbError other than ERR_ENTRY_ALREADY_EXISTSJoseph Sutton1-1/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Correctly assert that we found a LOGON_INFO PAC bufferJoseph Sutton1-1/+1
Because ‘found_logon_info’ was invariably true, we would miss the case in which set_pac_sids() failed to accomplish anything, having been unable to find the LOGON_INFO PAC buffer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Remove local variableJoseph Sutton1-3/+2
This seems a bit clearer to me. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Move KDC TGT tests to new fileJoseph Sutton2-48/+86
We can now rely on having MIT Kerberos 1.20 available. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30tests/krb5: Remove test of pre-1.20 MIT Kerberos behaviourJoseph Sutton1-21/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Use read_file() instead of readfp()Joseph Sutton3-8/+8
readfp() is deprecated and could be removed in a future version of Python. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Fix resource leaksJoseph Sutton6-13/+38
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Use assertEqual() instead of assertEquals()Joseph Sutton1-121/+121
assertEquals() is deprecated and could be removed in a future version of Python. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Check correct variablesJoseph Sutton1-14/+14
We were intending to check the keys, not the certificates. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Prefer ‘x not in y’ to ‘not x in y’Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Don’t shadow importsJoseph Sutton1-7/+7
Rename a variable that shadows an import of ‘gp_ext’. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Add missing importJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30pytest/dns_aging: Assert that the name of the node to search for is a stringJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30pytest/dns_aging: Correctly check that record is tombstonedJoseph Sutton1-5/+5
We were passing in as the name parameter to assert_tombstoned() an NDR Python object, rather than a string. This meant that the LDAP search filter would look something like this: (&(objectClass=dnsNode)(name=<dnsp.DnssrvRpcRecord talloc based object at 0x29abee0>)) and we would fail to find any records. These searches should have a better chance of working if we pass in the name of the record instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30pytest/dns_aging: Check value of ‘dtime’Joseph Sutton1-0/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python:tests: Rename test method so as not to mask previously-defined methodJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python:tests: Complete assertion messagesJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python:tests: Fix usage lineJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Fix reference to undefined name ‘samba’Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30samba-tool: Remove useless returnJoseph Sutton1-1/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python:join: Fix references to undefined variablesJoseph Sutton1-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 09:28:48 +0000