summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python
AgeCommit message (Collapse)AuthorFilesLines
2024-01-15python: Generate HRESULT definitions automaticallyJoseph Sutton2-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Joseph Sutton <jsutton@samba.org> Autobuild-Date(master): Mon Jan 15 01:56:53 UTC 2024 on atb-devel-224
2023-11-30python: move HRES_SEC_* constants to samba moduleRob van der Linde2-5/+2
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-30python: tests: make HRES_SEC_E_* constant an intRob van der Linde1-2/+2
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-30python: PEP275: docstrings should always use double quotesRob van der Linde1-6/+6
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-25s4:dsdb:tests: Remove unnecessary f‐stringsJoseph Sutton1-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-13s4:dsdb:tests: Use loadTestsFromTestCase() instead of makeSuite()Joseph Sutton8-8/+16
makeSuite() is deprecated and will be removed in Python 3.13. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-13s4:dsdb:tests: Fix assertion messagesJoseph Sutton2-9/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-13s4:dsdb:tests: Remove unused variablesJoseph Sutton2-16/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-13s4:dsdb:tests: Remove unused importsJoseph Sutton3-10/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Extend attribute read DirSync testsAndrew Bartlett1-56/+400
The aim here is to document the expected (even if not implemented) SEARCH_FLAG_RODC_ATTRIBUTE vs SEARCH_FLAG_CONFIDENTIAL, behaviour, so that any change once CVE-2023-4154 is fixed can be noted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Add test for SEARCH_FLAG_RODC_ATTRIBUTE behaviourAndrew Bartlett1-5/+40
SEARCH_FLAG_RODC_ATTRIBUTE should be like SEARCH_FLAG_CONFIDENTIAL, but for DirSync and DRS replication. Accounts with GUID_DRS_GET_CHANGES rights should not be able to read this attribute. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Speed up DirSync test by only checking positive ↵Andrew Bartlett1-1/+7
matches once When we (expect to) get back a result, do not waste time against a potentially slow server confirming we also get back results for all the other attribute combinations. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Check that secret attributes are not visible with ↵Andrew Bartlett1-0/+12
DirSync ever. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Force the test attribute to be not-confidential at ↵Andrew Bartlett1-4/+6
the start Rather than fail, if the last run failed to reset things, just force the DC into the required state. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Use self.addCleanup() and delete_force()Andrew Bartlett2-9/+3
Thie helps ensure this test is reliable even in spite of errors while running. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-10-10CVE-2023-4154 dsdb/tests: Do not run SimpleDirsyncTests twiceAndrew Bartlett1-5/+2
To re-use setup code, the super-class must have no test_*() methods otherwise these will be run as well as the class-local tests. We rename tests that would otherwise have duplicate names BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30s4:dsdb:tests: Fix usage linesJoseph Sutton2-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30s4:dsdb:tests: Remove unused importsJoseph Sutton11-56/+20
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30s4:dsdb:tests: Fix spellingJoseph Sutton1-4/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08s4:dsdb:tests: Remove unused variablesJoseph Sutton2-11/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08s4:dsdb:tests: Use control that was (presumably) intendedJoseph Sutton1-1/+1
Otherwise ‘control4’ goes unused. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-03s4:dsdb:tests: Fix code spellingAndreas Schneider14-39/+39
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-08-02selftest: Add test for combination of anr and paged_resultsAndrew Bartlett1-0/+21
This combination was known to cause a segfault in Samba 4.13, fixed by 5f0590362c5c0c5ee20503a67467f9be2d50e73b in later versions. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14970 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-24s4:dsdb/tests: also verify too old, older password interaction with badPwdCountStefan Metzmacher1-4/+85
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14054 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-24s4:dsdb/tests: Test Kerberos login with old password fails (but badPwdCount=0)Stefan Metzmacher1-5/+3
This demonstrates the pre-authentication failures with passwords from the password history don't incremend badPwdCount, similar to the NTLMSSP and simple bind cases. But it's still an interactive logon, which doesn't use 'old password allowed period'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14054 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-24s4-dsdb:large_ldap: Call setUpClass() method of base classJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16s4-dsdb:large_ldap: Remove unused variablesJoseph Sutton1-11/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16s4-dsdb:large_ldap: Remove unused importsJoseph Sutton1-6/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16pytest/password_lockout: Remove unused variablesJoseph Sutton1-15/+12
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16pytest/password_lockout: Use correct variableJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16pytest/password_lockout: Use more specific assertion methodsJoseph Sutton2-41/+41
These methods produce better error messages if an assertion fails. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16pytest/password_lockout: Remove unused importsJoseph Sutton2-9/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16s4:dsdb:tests: Refactor security descriptor testJoseph Sutton1-2/+2
Use more specific unittest methods. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16s4:dsdb:tests: Refactor confidential attributes testJoseph Sutton1-53/+16
Use more specific unittest methods, and remove unused code. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16s4:dsdb:tests: Refactor ACL testJoseph Sutton1-34/+30
Use more specific unittest methods; remove some unused variables. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-05s4/dsdb: fix unnecessary backslashRob van der Linde2-6/+6
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-05dsdb/tests: fix assignment to for loop variableRob van der Linde1-5/+5
because the loop variables are all called 'k' and the inner and outer loop both use 'k'. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:large_ldap: use a valid ACEDouglas Bagnall1-1/+1
Real ACEs don't have {} around their GUIDs. This will soon be banned. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-12pytest/acl: Remove unused remnants of source4/dsdb/tests/python/acl.pyJoseph Sutton1-58/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-12s4-dsdb:large_ldap: Note that we don't check that an error was raisedJoseph Sutton1-0/+16
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-12s4-dsdb:large_ldap: Assert that we got all the entriesJoseph Sutton1-0/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-12s4-dsdb:large_ldap: Fix disabled testJoseph Sutton1-3/+3
This test was silently skipped due to setUpClass() throwing a NameError. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-12s4-dsdb:large_ldap: Correctly increment count variableJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-12s4-dsdb:large_ldap: Fix typos in variable namesJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-06dsdb/tests: Add test for modification of unicodePwd over a cleartext/signed ↵Rob van der Linde1-0/+151
connection This demonstrates that the server did not detect CVE-2023-0922 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-06dsdb/tests: Double number of expressions in large_ldap.py ldap_timeout testAndrew Bartlett1-1/+1
By slowing the filter down more this makes the test reliable on the autobuild host. This is not a long-term solution, but is a quick tweak that can be done today to address current issues with getting commits past the host-based (compared with cloud-based) autobuild. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15351 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-06dsdb/tests: Move SD modification on class-created objects to classSetUpAndrew Bartlett1-10/+8
These modifications persist, so should be done at the class level, not in the test. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15351 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-05CVE-2023-0225 pytest/acl: test deleting dNSHostName as unprivileged userDouglas Bagnall1-0/+236
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15276 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-05dsdb: Remove remaining references to DC_MODE_RETURN_NONE and DC_MODE_RETURN_ALLAndrew Bartlett1-70/+16
The confidential_attrs test no longer uses DC_MODE_RETURN_NONE we can now remove the complexity. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-05CVE-2023-0614 ldb: Prevent disclosure of confidential attributesJoseph Sutton1-6/+6
Add a hook, acl_redact_msg_for_filter(), in the aclread module, that marks inaccessible any message elements used by an LDAP search filter that the user has no right to access. Make the various ldb_match_*() functions check whether message elements are accessible, and refuse to match any that are not. Remaining message elements, not mentioned in the search filter, are checked in aclread_callback(), and any inaccessible elements are removed at this point. Certain attributes, namely objectClass, distinguishedName, name, and objectGUID, are always present, and hence the presence of said attributes is always allowed to be checked in a search filter. This corresponds with the behaviour of Windows. Further, we unconditionally allow the attributes isDeleted and isRecycled in a check for presence or equality. Windows is not known to make this special exception, but it seems mostly harmless, and should mitigate the performance impact on searches made by the show_deleted module. As a result of all these changes, our behaviour regarding confidential attributes happens to match Windows more closely. For the test in confidential_attr.py, we can now model our attribute handling with DC_MODE_RETURN_ALL, which corresponds to the behaviour exhibited by Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 04:33:07 +0000