summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2024-05-16tests/krb5: Test that computers (and, by extension, gMSAs) cannot perform ↵Jo Sutton1-0/+16
interactive logons Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Don’t pass gMSA as ‘domain_joined_mach_creds’ parameterJo Sutton1-3/+1
We just want to test whether a gMSA can use netlogon. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Test performing NTLMSSP logons at different timesJo Sutton1-0/+375
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Test that gMSA passwords cannot be viewed over an unsealed ↵Jo Sutton1-0/+41
connection Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Add ‘expect_success’ parameter to gensec_ntlmssp_logon()Jo Sutton1-6/+14
View with ‘git show -b’. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Make use of gmsa_series_for_account() methodJo Sutton1-2/+28
This allows us to replace a call to expected_current_gmsa_password_blob() with one to expected_gmsa_password_blob(), a method which allows us to specify the exact key we expect. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Add quantized_time() methodJo Sutton1-4/+13
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16tests/krb5: Read current time from correct SamDBJo Sutton1-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16python:tests: Pass ServerPasswordSet2() parameters in correct orderJo Sutton1-2/+2
‘account_name’ and ‘server_name’ are passed in the wrong order. While Samba ignores the account name parameter and doesn’t have a problem with it missing its trailing dollar, Windows checks it and requires the trailing dollar to be present. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16python:tests: Remove unnecessary ‘pass’ statementJo Sutton1-1/+0
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16python:tests: Remove unused netlogon connection parameterJo Sutton1-13/+13
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-14smbd: Test reparse tag in smb3_posix_cc_infoVolker Lendecke1-0/+41
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-14tests: get TAG_INFORMATIONVolker Lendecke1-0/+24
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-14python/tests: Fix nlink test in smb3unix on btrfs filesystemPavel Filipenský1-4/+14
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Tue May 14 13:37:53 UTC 2024 on atb-devel-224
2024-05-14tests/ntlm_auth: Do not set a client_passwordStefan Metzmacher1-1/+1
This fixes test_ntlmssp_gss_spnego_cached_creds Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14tests/ntlm_auth_krb5: don't test that a krb5ccache work with an explicit ↵Stefan Metzmacher2-10/+16
username This test is useless and won't work anymore in future. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-10selftest: add test for User.get_primary_group methodRob van der Linde1-0/+15
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-05-10python: models: add get_primary_group method to User modelRob van der Linde1-0/+6
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-05-10python: models: rename argument ldb to samdbRob van der Linde13-169/+169
This argument is actually an instance of SamDB (which inherits from Ldb). This should have been called samdb. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-05-10tests/ntacls: unblock failing gitlab pipelines because test_setntacl_forcenativeStefan Metzmacher1-1/+1
This expects PermissionError: [Errno 1] Operation not permitted, but it seems that setxattr() for security.NTACL works on gitlab runners without being root. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07pytest: sid_strings: Samba DN object refuses sub-auth overflowDouglas Bagnall1-2/+2
We were mistakenly asserting something that did not happen with Windows, because Samba already won't parse the DN string. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07pytest: sid_strings: adjust to match Windows 2016Douglas Bagnall1-2/+2
9 hex-digit subauths like '0xABCDef123' will not fit in 32 bits, so should be rejected on parsing. In other situations, such as defaultSecurityDescriptor, overflowing SID subauths on Windows will saturate to 0xffffffff, resulting in a valid but probably meaningless SID. It is possible that in previous testing we saw that here, but it is more likely I got confused. In any case, now I see them being rejected, and that is good. The saturating defaultSecurityDescriptor case is tested in SidStringBehavioursThatWindowsAllows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07pytest: sid_strings: Windows does allow lowercase s-1-... SIDsDouglas Bagnall1-2/+4
And so should we. Right now, these tests won't pass against Windows because they rely on ldb pre-parsing of the SIDs, so they fail before Windows gets to see them. Running them against Windows looks something like this, BTW: SAMBA_SID_STRINGS_SKIP_LOCAL=1 \ SMB_CONF_PATH=st/ad_dc/etc/smb.conf \ PYTHONPATH=bin/default/python \ DC_SERVER=192.168.122.126 \ DC_USERNAME=Administrator DC_PASSWORD='xxx' \ python3 python/samba/tests/sid_strings.py When things are right, the only failing tests should be from the SidStringBehavioursThatSambaPrefers suite. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07pytest: sid_strings: use more reliable well known SIDDouglas Bagnall1-6/+6
It seems as if the well-known SID S-1-5-32-579 (DOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS) is not always present -- specifically, it was not there on the Windows machine used to develop these tests, but it is there on the one I am now using. S-1-5-32-545 (DOMAIN_ALIAS_RID_USERS) is surely going to exist, so we use that instead. That changes some of the assertions, making some NO_SUCH_OBJECTs into successes. For these tests we are only interested in the parsing of the SIDs, not their meaning, so it's OK to change it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-06tests: Test FSCTL_DELETE_REPARSE_POINTVolker Lendecke1-0/+63
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-06tests: Expected failures in reparse point tests should not be errorsVolker Lendecke1-4/+18
We need to put them into knownfail.d individually Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-06tests: Clean up behind ourselves in test_create_reparseVolker Lendecke1-1/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-06tests: Codify IO_REPARSE_TAG_MISMATCH behaviourVolker Lendecke1-2/+8
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-06tests: Clarify a reparse point testVolker Lendecke1-0/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-05-06selftest: Default to "tmp" share in reparsepoints.pyVolker Lendecke1-1/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2024-04-29python/samba/tests/blackbox: Add tests for Inherit-only flag propagationyuzu3671-0/+108
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15636 Signed-off-by: Anna Popova <popova.anna235@gmail.com> Reviewed-by: Noel Power <noel.power@suse.com> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-04-24python:tests: Store keys as bytes rather than as lists of intsJo Sutton1-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Apr 24 06:20:58 UTC 2024 on atb-devel-224
2024-04-24python:tests: Rewrite condition of while loopJo Sutton1-3/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-24python:tests: Store keys as bytes rather than as tuplesJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-24python:gkdi: Add helper methods returning previous and next GKIDsJo Sutton1-0/+6
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-24python: Move get_admin_sid() to SamDBJo Sutton1-0/+7
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-24tests/krb5: Check that updated NT hashes of gMSAs have the values we expectJo Sutton1-0/+19
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:ldap_server: add support for tls channel bindingsStefan Metzmacher1-0/+10
ldap server require strong auth = allow_sasl_over_tls is now an alias for 'allow_sasl_without_tls_channel_bindings' and should be avoided and changed to 'yes' or 'allow_sasl_without_tls_channel_bindings'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23tests/segfault.py: make sure samdb.connect(url) has a valid lp_ctxStefan Metzmacher1-0/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23python/samba/getopt: don't prompt for a password for --use-krb5-ccache=...Stefan Metzmacher1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15018 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-04-21tests/krb5: Test retrieving a denied gMSA password over an unsealed connectionJo Sutton1-9/+59
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Jo Sutton <jsutton@samba.org> Autobuild-Date(master): Sun Apr 21 23:17:53 UTC 2024 on atb-devel-224
2024-04-21tests/krb5: Note that lockout tests use password checksJo Sutton1-1/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21tests/krb5: Fix malapropismJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21pyglue: Remove unnecessary declarationJo Sutton1-1/+0
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21python: Reformat codeJo Sutton1-8/+10
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21tests/krb5: Add tests that gMSA keys are updated in the database when ↵Jo Sutton1-1/+132
appropriate Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21tests/krb5: Import MAX_CLOCK_SKEW more directlyJo Sutton1-1/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21tests/krb5: Extract method to unpack supplementalCredentials blobJo Sutton1-16/+26
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21tests/krb5: Skip loop iteration if attribute has no valuesJo Sutton1-5/+5
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-17python: Fix NtVer check for site_dn_for_machine()Andreas Schneider1-3/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15633 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Apr 17 19:32:11 UTC 2024 on atb-devel-224
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 00:29:31 +0000