summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python
AgeCommit message (Collapse)AuthorFilesLines
2022-10-21s4-dsdb: Remove unused variables in token_group python testJoseph Sutton1-2/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-21s4-dsdb: simplify conditional in python token_group testJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-21s4-dsdb: Remove unused import in token_group python testJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-21s4-dsdb: Use Python 'del' rather than assigning over with NoneJoseph Sutton1-2/+2
This is the clearer way to trigger the destruction of this variable and so the LDB connection under it. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-21s4-dsdb: remove unused Python variablesJoseph Sutton1-7/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-21s4-dsdb: Use a raw python string to avoid creating and invalid escape sequenceJoseph Sutton1-3/+3
While the invalid escape sequence worked and was passed to the LDB layer for it's use, linting tools will complain so we should not do this. We don't want to get caught out when a future python version becomes more strict. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-09-16pytests:s4/dsdb/passwords: avoid unused importsDouglas Bagnall1-4/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Sep 16 06:47:43 UTC 2022 on sn-devel-184
2022-09-16pytest/password_lockout: be less verbose by defaultDouglas Bagnall2-21/+27
leaving the carefully constructed verbosity there for whoever choses to switch it on. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720: s4-acl: Owner no longer has implicit Write DACLNadezhda Ivanova1-9/+36
The implicit right of an object's owner to modify its security descriptor no longer exists, according to the new access rules. However, we continue to grant this implicit right for fileserver access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720: s4-acl: Adjusted some tests to work with the new behaviorNadezhda Ivanova3-10/+17
Test using non-priviledged accounts now need to make sure they have WP access on the prvided attributes, or Write-DACL Some test create organizational units with a specific SD, and those now need the user to have WD or else they give errors BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720: s4-acl: Change behavior of Create Children checkNadezhda Ivanova2-9/+26
Up to now, the rights to modify an attribute were not checked during an LDAP add operation. This means that even if a user has no right to modify an attribute, they can still specify any value during object creation, and the validated writes were not checked. This patch changes this behavior. During an add operation, a security descriptor is created that does not include the one provided by the user, and is used to verify that the user has the right to modify the supplied attributes. Exception is made for an object's mandatory attributes, and if the user has Write DACL right, further checks are skipped. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720 s4-acl: Test Create Child permission should not allow full ↵Nadezhda Ivanova1-6/+2404
write to all attributes Up to now, the rights to modify an attribute were not checked during an LDAP add operation. This means that even if a user has no right to modify an attribute, they can still specify any value during object creation, and the validated writes were not checked. This patch includes tests for the proposed change of behavior. test_add_c3 and c4 pass, because mandatory attributes can still be set, and in the old behavior SD permissions were irrelevant BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720 s4:tests/sec_descriptor: Add missing security descriptor modifyJoseph Sutton1-1/+3
The variable sub_sddl1 previously went unused, so this call to modify_sd_on_dn() was presumably intended to go here. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08pytest/password-lockout: fix using samba_tool functionDouglas Bagnall1-7/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-07-28CVE-2022-32743 s4-acl: Add tests for validated dNSHostName writeJoseph Sutton1-0/+757
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14833 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-07-27CVE-2022-32746 s4:dsdb:tests: Add test for deleting a disallowed SPNJoseph Sutton1-0/+26
If an account has an SPN that requires Write Property to set, we should still be able to delete it with just Validated Write. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-06-26dsdb: Allow password history and password changes without an NT hashAndrew Bartlett1-4/+1
We now allow this to be via the ENCTYPE_AES256_CTS_HMAC_SHA1_96 hash instead which allows us to decouple Samba from the unsalted NT hash for organisations that are willing to take this step (for user accounts). (History checking is limited to the last three passwords only, as ntPwdHistory is limited to NT hash values, and the PrimaryKerberosCtr4 package only stores three sets of keys.) Since we don't store a salt per-key, but only a single salt, the check will fail for a previous password if the account was renamed prior to a newer password being set. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-06-14python: Don't use deprecated escape sequencesJoseph Sutton2-4/+4
Certain escape sequences are not valid in Python string literals, and will eventually result in a SyntaxError. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-06-09tests/krb5/test_ldap.py: Increase maximum threshold for LDAP timeoutJoseph Sutton1-2/+2
This test often fails because the server takes too long to time out. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05tests/passwords: Add tests for password history with simple bindsJoseph Sutton1-8/+243
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05tests/passwords: Remove unused importsJoseph Sutton1-2/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05selftest: Rework password_lockout_base.py to allow logon_basics test to be ↵Andrew Bartlett2-17/+31
run in ad_dc_no_ntlm We need to ensure that even if NTLM is disabled, that the test can still bootstrap and fail normally. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-04-13s4:dsdb:tests: Also pass tests if asserted identity is presentAndreas Schneider1-17/+96
We should make sure that we use NTLMSSP or Kerberos consistently for the tests and don't mix them. We're also much stricter and symmetric_difference() to check if the sets are actually the same. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/sam: Ensure that Protected Users group cannot be deletedJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/passwords: Test that LDAP password changes work for Protected UsersJoseph Sutton1-0/+77
We want to disable SAMR password changes for Protected Users, but need to ensure that other methods of changing the password still work. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/password_lockout: Test NTLM and SAMR password changes with Protected UsersJoseph Sutton1-0/+277
Test that NTLM and SAMR password changes cannot be used for Protected Users, and that lockouts are not triggered for attempting to use them. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17selftest: Cope with LM hash not being stored in the tombstone_reanimation testAndrew Bartlett1-2/+2
The removal of LM hash storage changes the expected metadata. We do not need to track these values exactly to prove the behaviour here. This is not due to the changes in password_hash directly, which in update_final_msg() sets DSDB_FLAG_INTERNAL_FORCE_META_DATA to force a push out of the removed attribute to the replication state. However at the stage of a subsequent LDAP Delete there is no longer a lmPwdHistory nor dBCSPwd attribute, in the directory, so there is no subsequent version bump to remove them when building a tombstone. Samba's behaviour is different to that seen by Metze on windows 2022, where he sees dBCSPwd removed (for the no LM store case) but lmPwdHistory kept. We in Samba choose to differ, not storing an ambiguous LM hsitory (of "" values likely), so allowing any version for these two attributes is the sensible choice. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-10rodc: Add tests for simple BIND alongside NTLMSSP bindsGarming Sam1-22/+37
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: add test_login_basics_simple()Stefan Metzmacher1-7/+19
This demonstrates that 'old password allowed period' also applies to LDAP simple binds and not only to GSS-SPNEGO/NTLMSSP binds. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15001 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: prepare BasePasswordTestCase for simple bind testsStefan Metzmacher1-3/+17
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: introduce assertLoginSuccessStefan Metzmacher2-5/+15
This makes it possible to catch failures with knownfail entries. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: make use of assertLoginFailure helperStefan Metzmacher1-6/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: let all BasePasswordTestCase tests provide self.host_url[_ldaps]Stefan Metzmacher3-7/+9
This will make further changes easier. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: passwords.py don't need to import BasePasswordTestCaseStefan Metzmacher1-1/+0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-06s4:kdc: redirect pre-authentication failures to an RWDCStefan Metzmacher1-2/+1
The most important case is that we still have a previous password cached at the RODC and the inbound replication hasn't wiped the cache yet and we also haven't triggered a new replication yet. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14865 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-30selftest: Check received LDB error code when STRICT_CHECKING=0Joseph Sutton1-1/+1
We were instead only checking the expected error. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-25CVE-2021-3670 tests/krb5/test_ldap.py: Add test for LDAP timeoutsJoseph Sutton1-0/+63
We allow a timeout of 2x over to avoid this being a flapping test. Samba is not very accurate on the timeout, which is not otherwise an issue but makes this test fail sometimes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Add test for duplicate servicePrincipalNames on an ↵Joseph Sutton1-0/+21
add operation BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adapt ldap.py tests to new objectClass restrictionsJoseph Sutton1-14/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722: s4-acl: test Control Access Rights honor the Applies-to ↵Nadezhda Ivanova1-0/+17
attribute Validate Writes and Control Access Rights should only grant access if the object is of the type listed in the Right's appliesTo attribute. Tests to verify this behavior BUG: https://bugzilla.samba.org/show_bug.cgi?id=14832 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 s4:dsdb:tests: Add missing self.fail() callsJoseph Sutton1-0/+32
Without these calls the tests could pass if an expected error did not occur. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14832 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> [abartlet@samba.org Included in backport as changing ACLs while ACL tests are not checking for unexpected success would be bad]
2021-11-09CVE-2020-25722 Add test for SPN deletion followed by additionJoseph Sutton1-0/+48
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14876 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> [abartlet@samba.org Removed transaction hooks, these do nothing over remote LDAP]
2021-11-09CVE-2020-25722 selftest/user_account_control: more work to cope with ↵Andrew Bartlett1-17/+29
UAC/objectclass defaults and lock This new restriction breaks a large number of assumptions in the tests, like that you can remove some UF_ flags, because it turns out doing so will make the 'computer' a 'user' again, and this will fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest/user_account_control: Allow a broader set of ↵Andrew Bartlett1-4/+8
possible errors This favors a test that confirms we got an error over getting exactly the right error, at least for now. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Allow self.assertRaisesLdbError() to take a list of ↵Andrew Bartlett1-0/+5
errors to match with BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: adapt ldap.py/sam.py test_all tests to new default ↵Andrew Bartlett2-7/+10
computer behaviour Objects of objectclass computer are computers by default now and this changes the sAMAccountType and primaryGroupID as well as userAccountControl BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adapt sam.py test to userAccountControl/objectclass ↵Andrew Bartlett1-3/+3
restrictions BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: New objects of objectclass=computer are ↵Andrew Bartlett1-2/+2
workstations by default now BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adjust sam.py ↵Andrew Bartlett1-1/+1
test_userAccountControl_computer_add_trust to new reality We now enforce that a trust account must be a user. These can not be added over LDAP anyway, and our C code in the RPC server gets this right in any case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Split test_userAccountControl into unit testsAndrew Bartlett1-1/+20
The parts that create and delete a single object can be safely split out into an individual test. At this point the parts that fail against Windows 2019 are: error: __main__.SamTests.test_userAccountControl_computer_add_normal [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_computer_modify [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_user_add_0_uac [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_user_add_normal [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_user_modify [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 05:13:59 +0000