summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2023-08-30python: Fix invalid escape sequencesJoseph Sutton4-38/+38
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Remove redundant backslashesJoseph Sutton11-19/+19
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Remove unused importsJoseph Sutton46-73/+19
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Fix spellingJoseph Sutton5-11/+11
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-28gp: Send list of keys instead of dict to removeGabriel Nagy1-1/+1
`cache_get_all_attribute_values` returns a dict whereas we need to pass a list of keys to `remove`. These will be interpolated in the gpdb search. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224
2023-08-28gp: Test disabled enrollment unapplies policyGabriel Nagy1-0/+54
For this we need to stage a Registry.pol file with certificate autoenrollment enabled, but with checkboxes unticked. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Template changes should invalidate cacheGabriel Nagy1-5/+10
If certificate templates are added or removed, the autoenroll extension should react to this and reapply the policy. Previously this wasn't taken into account. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Test adding new cert templates enforces changesGabriel Nagy2-1/+50
Ensure that cepces-submit reporting additional templates and re-applying will enforce the updated policy. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Convert CA certificates to base64Gabriel Nagy1-3/+2
I don't know whether this applies universally, but in our case the contents of `es['cACertificate'][0]` are binary, so cleanly converting to a string fails with the following: 'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte We found a fix to be encoding the certificate to base64 when constructing the CA list. Section 4.4.5.2 of MS-CAESO also suggests that the content of `cACertificate` is binary (OCTET string). Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Test with binary content for certificate dataGabriel Nagy1-4/+4
This fails all GPO-related tests that call `gpupdate --rsop`. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Change root cert extension suffixGabriel Nagy1-1/+2
On Ubuntu, certificates must end in '.crt' in order to be considered by the `update-ca-certificates` helper. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Support update-ca-trust helperGabriel Nagy1-1/+5
This is used on RHEL/Fedora instead of update-ca-certificates. They behave similarly so it's enough to change the command name. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Support more global trust directoriesGabriel Nagy1-1/+11
In addition to the SUSE global trust directory, add support for RHEL and Debian-based distributions (including Ubuntu). To determine the correct directory to use, we iterate over the variants and stop at the first which is a directory. In case none is found, fallback to the first option which will produce a warning as it did previously. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28samba-tool: Allow LDB URL to be NoneJoseph Sutton1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15458 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest: compare Samba vs Windows SDDL security descriptorsDouglas Bagnall1-0/+147
Can Samba understand Windows security descriptors? Does it parse SDDL the same way? Here we test on over 7000 SDDL/descriptor pairs and find the answer is pleasing. In later commits we will add more tests using different classes of ACE. The test cases are derived from fuzz seeds, exported to Windows via the script in the last commit, with the Windows descriptor bytes found using libcli/security/tests/windows/windows-sddl-test.py. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24python/colour: add a colour diff helperDouglas Bagnall1-0/+32
Sometimes colour can help show what is different between two strings. This is roughly the same as `git diff --no-index --color-words=. <a> <b>`. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: tests for more invalid or weird casesDouglas Bagnall1-0/+11
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: add option for case-insensitive testsDouglas Bagnall1-1/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: environment option for exporting as fuzz seedsDouglas Bagnall1-1/+22
We want realistic examples for sddl fuzzing seeds, and we want realistic examples for sddl tests, so hopefully we only need to get it right once. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: replace/export tests based on environment varsDouglas Bagnall1-42/+45
We had a stupid system involving test functions with side-effects, that needed to be enabled by editing the file. Now you get the same effects by setting environment variables, the names of which you can only learn by reading the file closely. This works better because some stuff needs to happen at class-time rather than instance-time. Also the environment variables specify the import and export locations. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytests: add helper to grab a directory from environmentDouglas Bagnall1-0/+16
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:tests: Save files with intended contentsJoseph Sutton1-1/+1
We presumably here meant to use the variable ‘contents’, not ‘test_contents’. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:tests: Fix spellingJoseph Sutton4-4/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:tests: Reuse policies and silos created by setUp() across all testsJoseph Sutton2-36/+54
We now create the claims in setUp() only once, preserving them so as to reuse them across all of the tests using this class. Then we finally delete them all in tearDownClass(). addClassCleanup() could make this cleaner, but it’s available only in Python 3.8 and above. This change reduces the time taken by my machine to run samba.tests.samba_tool.domain_auth_policy from two minutes to ten seconds. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:tests: Reuse claims created by setUp() across all testsJoseph Sutton1-19/+50
We now create the claims in setUp() only once, preserving them so as to reuse them across all of the tests in this class. Then we finally delete them all in tearDownClass(). addClassCleanup() could make this cleaner, but it’s available only in Python 3.8 and above. This change reduces the time taken by my machine to run these tests from four minutes to twenty seconds. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:tests: Make getSamDB() a static methodJoseph Sutton1-1/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:subunit: Use ‘is’ to compare variables with singletonsJoseph Sutton1-4/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:subunit: Fix docstringJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:netcmd: Remove semicolonJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:netcmd: Add missing newlines to error messagesJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-15tests/krb5: Remove incorrect commentsJoseph Sutton1-4/+0
Now that the INT64 claim IDL definition has been corrected, these tests should pass against Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15452 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Aug 15 19:41:50 UTC 2023 on atb-devel-224
2023-08-15tests/krb5: Add a test decoding INT64 PAC claims issued by WindowsJoseph Sutton1-0/+74
Our NDR code currently handles INT64 claims incorrectly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15452 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-15tests/krb5: Shorten long linesJoseph Sutton1-2/+91
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15452 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-15tests/krb5: Remove unused importJoseph Sutton1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15452 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Test that neither forwardable nor proxiable tickets are issued ↵Joseph Sutton1-0/+71
to Protected Users Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Allow specifying KDC options when requesting a TGTJoseph Sutton1-4/+9
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Allow specifying additional details for a test accountJoseph Sutton1-0/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Split out new AuthnPolicyBaseTests classJoseph Sutton1-1/+3
This class provides a useful base for other tests to build upon. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Move some functions round to prepare for splitting the classJoseph Sutton1-169/+169
No effective code change. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Keep claim types for subsequent testsJoseph Sutton1-2/+2
We want to be able to reuse them across several tests. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Rename compatability_tests classJoseph Sutton1-2/+2
We should not have two unrelated classes both named SimpleKerberosTests. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14tests/krb5: Allow cached=True with an assigned silo or policyJoseph Sutton1-3/+5
We might want to create an account with an assigned silo or policy in setUp() or setUpClass() to be reused in subsequent tests. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14krb5: Increase the minimum MIT Krb5 version to 1.21Andrew Bartlett1-2/+2
This is the version we test with in CI after the image update in the next commit. This addresses the issues that were fixed in CVE-2022-37967 (KrbtgtFullPacSignature) and ensures that Samba builds against the MIT version that allows us to avoid that attack. The hooks to allow these expectations to be disabled in the tests are kept for now, to allow this to be reverted or to test older servers. With MIT 1.21 as the new test standard for the MIT KDC build we update the knownfail_mit_kdc - this was required regadless after the CI image update. Any update to the CI image, even an unrelated one, brings in a new MIT Krb5, version 1.21-3 in this case. This has new behaviour that needs to be noted in the knownfail files or else the tests, which haven't changed, will fail and pipelines won't pass. (The image generated by the earlier bootstrap commit brought in krb5-1.21-2 which was buggy with CVE-2023-39975) Further tweaks to tests or the server should reduce the number of knownfail entries, but this keeps the pipelines passing for now. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15231 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-08-13python/samba/netcmd/domain/schemaupgrade.py: fix missing newlineMichael Tokarev1-1/+1
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Aug 13 22:54:55 UTC 2023 on atb-devel-224
2023-08-08tests/krb5: Correct commentJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08python:tests: Remove references to now-gone filesJoseph Sutton1-2/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08pyglue: Add missing whitespace in docstringsJoseph Sutton1-3/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08pyglue: Fix leakJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08python: Check return value of talloc_strndup()Joseph Sutton1-0/+5
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08python: Fix leakJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 11:25:08 +0000