summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2025-10-10mdssvc: implement elasticsearch:default_fieldsRalph Boehme2-4/+8
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15927 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-10-10mdssvc: fix filtering by share path prefixRalph Boehme2-8/+60
To correctly filter by share path, use a filter with a prefix match. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15927 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-10-10tests:s4:kdc Add tests for pkinit certificate mappingGary Lockyer3-1/+1172
Tests for pkinit with "strong certificate binding enforcement" See: https://support.microsoft.com/en-us/topic/ kb5014754-certificate-based-authentication-changes-on-windows-domain -controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 KB5014754: Certificate-based authentication changes on Windows domain controllers Test environment configuration: ad_dc none ad_dc_ntcfs compatibility ad_dc_smb1 full Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-10-10python:domain:user Add altSecurityIdentitiesGary Lockyer1-0/+1
Add altSecurityIdentities to the User domain model so that it can be used by the key certificate binding enforcement tests. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-10-10s4:dsdb:audit_log change action for auth infoGary Lockyer1-9/+9
Change the action logged for authentication information changes from "Public key change" to "Auth info change". To reflect that it's not just changes to public keys that get logged. This doesn't require a JSON log format version change, because the version was recently bumped in c9e752ab18f43758d704951f7f31e39dafa6fdb4 and there hasn't been a Samba release in the meantime. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-10-10tests:audit_log_pass_change add tests for auth info loggingGary Lockyer1-2/+66
Add tests for the logging of changes to altSecurityIdentities, dnsHostName, servicePrincipalName and msDS-AdditionalDnsHostNames Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-10-10tests:audit_log_pass_change refactor the testsGary Lockyer1-67/+97
Refactor python/samba/tests/audit_log_pass_change.py to make it easier add tests for the logging of changes to alternateSecurityIdentities, dNSHostName, servicePrincipleName Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-09-16tests:krb5 Add key trust testsGary Lockyer2-1/+503
Add tests to verify Key Trust authentication Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-09-03dsdb:audit:test: test msDS-KeyCredentialLink change loggingDouglas Bagnall1-2/+287
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-27setup:adprep: Import the latest ↵Jennifer Sutton1-3/+3
{Domain-Wide,Forest-Wide,Read-Only-Domain-Controller,Schema}-Updates.md Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27python:samba: Raise an exception if we can’t parse a Markdown operationJennifer Sutton1-4/+5
Otherwise we would continue with the wrong GUID and filename. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27schema: Add Validated-Write-Computer Extended Right from Windows Server 2016Jennifer Sutton1-3/+8
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27tests/krb5: Remove redundant lineJennifer Sutton1-2/+0
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-26python:tarfile: notes about extraction_filterDouglas Bagnall1-1/+16
a reminder to delete. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Aug 26 23:43:08 UTC 2025 on atb-devel-224
2025-08-26pytest: safe_tarfile: accept NotADirectoryError as bad path rejectionDouglas Bagnall1-1/+2
After recent upstream Python fixes for various path escape and symlink CVEs in tarfile, in particular this commit: commit 3612d8f51741b11f36f8fb0494d79086bac9390a Author: Łukasz Langa <lukasz@langa.pl> Date: Tue Jun 3 12:42:11 2025 +0200 gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` (#135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. Signed-off-by: Łukasz Langa <lukasz@langa.pl> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> our ../../ test that looks for a tarfile.OutsideDestinationError now meets a NotADirectoryError in recent Python versions (this from 3.13, Fedora 42): UNEXPECTED(error): samba.tests.safe_tarfile.samba.tests.safe_tarfile.SafeTarFileTestCase.test_dots(none) REASON: Exception: Exception: Traceback (most recent call last): File "/tmp/samba-testbase/b1/samba-o3/bin/python/samba/tests/safe_tarfile.py", line 48, in test_dots self.assertRaises(tarfile.OutsideDestinationError, ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ stf.extractall, ^^^^^^^^^^^^^^^ tarname) ^^^^^^^^ File "/usr/lib64/python3.13/unittest/case.py", line 795, in assertRaises return context.handle('assertRaises', args, kwargs) ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/unittest/case.py", line 238, in handle callable_obj(*args, **kwargs) ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/tarfile.py", line 2343, in extractall tarinfo, unfiltered = self._get_extract_tarinfo( ~~~~~~~~~~~~~~~~~~~~~~~~~^ member, filter_function, path) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/tarfile.py", line 2432, in _get_extract_tarinfo self._handle_fatal_error(e) ~~~~~~~~~~~~~~~~~~~~~~~~^^^ File "/usr/lib64/python3.13/tarfile.py", line 2430, in _get_extract_tarinfo filtered = filter_function(unfiltered, path) File "/usr/lib64/python3.13/tarfile.py", line 842, in tar_filter new_attrs = _get_filtered_attrs(member, dest_path, False) File "/usr/lib64/python3.13/tarfile.py", line 783, in _get_filtered_attrs target_path = os.path.realpath(os.path.join(dest_path, name), strict=os.path.ALLOW_MISSING) File "<frozen posixpath>", line 457, in realpath NotADirectoryError: [Errno 20] Not a directory: '/tmp/samba-testbase/b1/samba-o3/bin/ab/tmp/tmpbn6e69ci/tar.tar' In this commit, we say that a NotADirectoryError is OK. When we started safe_tarfile we were acting in advance of upstream Python, but now they are well ahead of us. If we trust their work in recent versions and accept the error conditions they choose, we can more easily get rid of our safe_tarfile when the time is right. For the moment we still support as far back as Python 3.6 for some old enterprise distros, and it is for those that we continue to maintain safe_tarfile. In versions before 3.11 we will see tarfile.ExtractError, and the test for that is unaffected by this change. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-26python:build: do not allow sizeof(int) != 4Douglas Bagnall1-0/+13
A non-32 bit int will (if the compiler allows it) result in code where we write into memory adjacent to a target uint32_t value in many python bindings using the python arg-parsing API. The more correct thing to do would be to always parse into an unsigned long long and error if it is greater than UINT32_MAX, but we do this in so many places that there is reason to believe we'll just keep adding more. Note, we already check in lib/replace/wscript that int is at least 32 bits; here we are effectively just checking that it is not more. There was apparently a version of 64 bit Solaris in the 1990s that had 64 bit ints. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-08-25auth:creds: Make sure to uppercase the realm of a principalAndreas Schneider1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15893 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-08-20pytest:samba-tool group: remove unused importsDouglas Bagnall1-5/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Aug 20 05:35:03 UTC 2025 on atb-devel-224
2025-08-20pytest: run user_keytrust tests as computer keytrust testsDouglas Bagnall1-0/+16
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20pytest: adapt user_keytrust tests to be objectclass agnosticDouglas Bagnall1-89/+95
We will reuse the tests for the computer keytrust command. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: copy user_keytrust to computer keytrustDouglas Bagnall2-0/+226
This is exactly a copy of user/keytrust.py to computer_keytrust.py with a title-case-preserving `s/user/computer/`. It works. The Computer model differs from the User model in that it appends a '$' to the end of account names if it senses the lack, otherwise these commands are using the same code paths. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool computer: remove unused importsDouglas Bagnall1-4/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add user keytrust commandDouglas Bagnall3-0/+585
This allows manipulation of key credential links for users. See `man -l bin/default/docs-xml/manpages/samba-tool.8` for documentation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: Command.message() can print multiple linesDouglas Bagnall1-2/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:key_credential_link: filter_kcl_list helper for samba-toolDouglas Bagnall1-0/+27
This will be used in `samba-tool user keytrust delete` and `samba-tool computer keytrust delete` and is mainly to deduplicate that code. Potentially it could also be used in `keytrust view`. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:key_credential_list: add kcl_in_list functionDouglas Bagnall1-0/+13
This compares the key material and DN of a KeyCredentialLinkDn with a list of others, which is a different sense of equality than the default (which considers GUIDs and binary equality). This will be used by samba-tool to check whether a link is in fact a duplicate even if it seems not to be due to some insignificant field being non-identical. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:key_credential_links: allow encoding=='auto'Douglas Bagnall1-1/+4
'auto' is the same as None. This is helpful to samba-tool. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add verbose flag to @exception_to_command_errorDouglas Bagnall1-1/+19
Helpful in development. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:tests: test key_credential_link moduleDouglas Bagnall1-0/+307
These tests use the samba.key_credential_link module and a real samdb. The existing key_credential_link tests address the IDL generated structures more directly. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20python:key_credential_link: add descriptive methodsDouglas Bagnall1-2/+124
In samba-tool we are going to want a KeyCredentialLinkDn to be able to describe itself. We're adding the methods here because `samba-tool user` and `samba-tool computer` will both want to use them. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20python:models: do not re-use mutable defaultsDouglas Bagnall1-1/+1
This ensures that model.save works when a field has the many flag set, but the object has no attribute of that name, and the caller appends to the attribute list, like this: user.key_credential_link.append(link) When we get to save, and are doing this: value = getattr(self, attr) old_value = getattr(existing_obj, attr) if value != old_value: # commit the change the .append() will have added the item to both value and old_value because they are the same list. But not any more. This was a problem because the Field instance is attached to the model class, not the model instance. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add decorator to catch exception typesDouglas Bagnall1-0/+18
Often we [think we] know that all exceptions of a certain type should be formatted as CommandErrors (i.e., the traceback is suppressed, and the message is assumed intelligible). Rather than riddling .run() with try...except blocks to do this, we can @exception_to_command_error(ModelError) def run(...) which makes any ModelError into a CommandError in that samba-tool command. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-15CI: add Python test samba.tests.dcerpc.dfs.DfsTests.test_dfs_reparse_tagRalph Boehme1-0/+48
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15843 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-15python/tests: also populate self.server in calls LibsmbTests setup()Ralph Boehme1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15843 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-13python:key_credential_link: old python compatibilityDouglas Bagnall1-1/+1
int.to_bytes assumed these defaults in recent versions Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-13python:models: add key credential link DN to domain fieldsDouglas Bagnall2-0/+45
This will soon be needed by samba-tool, and is also going to be used in some tests. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-08python:ndr: improve type annotation and docs for pack/unpackDouglas Bagnall1-6/+10
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Aug 8 00:29:00 UTC 2025 on atb-devel-224
2025-08-07python:samdb: remove dsdb_Dn aliasDouglas Bagnall1-5/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py:samdb: add get_linearized to dsdb_dnDouglas Bagnall2-1/+6
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py:samdb: drop unused methods (get_binary_integer, get_bytes)Douglas Bagnall1-9/+1
get_binary_integer() is still a method on BinaryDn, but not on StringDn and PlainDn where it makes no sense. x.get_bytes() is merely an alias for x.binary. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest: add key_credential_link_Dn testsDouglas Bagnall1-0/+83
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07python: add helpers to construct KeyCredentialLinkDn objectsDouglas Bagnall1-1/+161
We want to ensure the as best we can that the binary blob is in a useful format. This will be used by samba-tool. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07python: add KeyCredentialLinkDn BinaryDn subtypeDouglas Bagnall1-0/+56
This works as a BinaryDn, but it also does validation to ensure the binary contains a KEYCREDENTIALLINK_BLOB. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07samba_kcc: log when msDS-HasInstantiatedNCs is not BinaryDnDouglas Bagnall1-3/+10
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07samba_kcc: use dsdb_dn_guess()Douglas Bagnall2-12/+12
We also remove a bit of .decode()ing, which now happens automatically. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07dbcheck: make deleted_objects check case-insensitiveDouglas Bagnall1-3/+4
While a BinaryDn.prefix is generated in upper-case, and dsdb.DS_GUID_DELETED_OBJECTS_CONTAINER is upper-case, we can avoid having to think about that by comparing the actual bytes. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07dbcheck: use new dsdb_dn typesDouglas Bagnall1-11/+12
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:krb5_base: use BinaryDn not dsdb_dnDouglas Bagnall1-4/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:dsdb_dn: expand and rework testsDouglas Bagnall1-29/+77
We now test the specialised StringDn and BinaryDn types. There are new assertions about case-insensitivity in binary hex strings and BinaryDn prefix validation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:dsdb_dn: fix binary testDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 18:01:14 +0000