summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python
AgeCommit message (Collapse)AuthorFilesLines
2021-11-09CVE-2020-25722 dsdb: Improve privileged and unprivileged tests for ↵Andrew Bartlett1-47/+125
objectclass/doller/UAC This helps ensure we cover off all the cases that matter for objectclass/trailing-doller/userAccountControl BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Catch errors from samdb.modify() in ↵Andrew Bartlett1-5/+26
user_account_control tests This will allow these to be listed in a knownfail shortly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Catch possible errors in ↵Andrew Bartlett1-11/+19
PasswordSettingsTestCase.test_pso_none_applied() This allows future patches to restrict changing the account type without triggering an error. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Test combinations of account type and objectclass ↵Andrew Bartlett1-0/+165
for creating a user The idea here is to split out the restrictions seen on Windows 2019 at the schema level, as seen when acting as an administrator. These pass against Windows 2019 except for the account type swapping which is not wanted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Extend priv_attrs test - work around ↵Andrew Bartlett1-15/+25
UF_NORMAL_ACCOUNT rules on Windows 2019 (requires |UF_PASSWD_NOTREQD or a password) - extend to also cover the sensitive UF_TRUSTED_FOR_DELEGATION BUG: https://bugzilla.samba.org/show_bug.cgi?id=14703 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14778 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14775 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 dsdb: Tests for our known set of privileged attributesAndrew Bartlett1-0/+388
This, except for where we choose to disagree, does pass against Windows 2019. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14703 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14778 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14775 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-10-20selftest: Increase account lockout windows to make test more realiableJoseph Sutton1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-10-20pytest/rodc_rwdc: try to avoid race.Douglas Bagnall1-0/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-10-04selftest: Use self.assertRaisesLdbError() in user_account_control.py testAndrew Bartlett1-63/+37
This changes most of the simple pattern with self.samdb.modify() to use the wrapper. Some other calls still need to be converted, while the complex decision tree tests should remain as-is for now. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Oct 4 21:55:43 UTC 2021 on sn-devel-184
2021-10-04selftest: Move self.assertRaisesLdbError() to samba.tests.TestCaseAndrew Bartlett2-46/+0
This is easier to reason with regarding which cases should work and which cases should fail, avoiding issues where more success than expected would be OK because a self.fail() was missed in a try: block. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-09-15selftest: Update user_account_control tests to pass against Windows 2019Andrew Bartlett1-12/+102
This gets us closer to passing against Windows 2019, without making major changes to what was tested. More tests are needed, but it is important to get what was being tested tested again. Account types (eg UF_NORMAL_ACCOUNT, UF_WORKSTATION_TRUST_ACCOUNT) are now required on all objects, this can't be omitted any more. Also for UF_NORMAL_ACCOUNT for these accounts without a password set |UF_PASSWD_NOTREQD must be included. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 15 08:49:11 UTC 2021 on sn-devel-184
2021-09-04python: Fix usage stringsJoseph Sutton6-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-09-02selftest: Replace internal loop in test_uac_bits_set() using @DynamicTestClassAndrew Bartlett1-20/+25
This generates a single test per bit which is easier to debug. Elsewhere we use this pattern where we want to be able to put some cases in a knownfail, which is otherwise not possible. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Replace internal loop in test_uac_bits_add() using @DynamicTestClassAndrew Bartlett1-19/+35
This generates a single test per bit which is easier to debug. Elsewhere we use this pattern where we want to be able to put some cases in a knownfail, which is otherwise not possible. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Use @DynamicTestCase in user_account_control ↵Andrew Bartlett1-8/+11
test_uac_bits_unrelated_modify() This is a nice easy example of how the test generation code works, and it combined nicely with the earlier patch to return string names from the UF_ constants. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Use addCleanup rather than tearDown in user_account_control.pyAndrew Bartlett1-8/+2
self.addCleanup() is called regardless of the test failure or error status and so is more reliable, particularly during development. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Modernise user_account_control.py tests use a common self.OUAndrew Bartlett1-23/+23
We set and use a single self.OU to ensure consistancy and reduce string duplication. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall29-29/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-11-04selftest: add test for new "samba-tool user unlock" commandBjörn Baumbach2-0/+21
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Nov 4 00:19:25 UTC 2020 on sn-devel-184
2020-10-21s4:dsdb:tests: add AclVisibiltyTestsStefan Metzmacher1-1/+320
This tests a sorts of combinations in order to demonstrate the visibility of objects depending on: - with or without fDoListObject - with or without explicit DENY ACEs - A hierachy of objects with 4 levels from the base dn - SEC_ADS_LIST (List Children) - SEC_ADS_LIST_LIST_OBJECT (List Object) - SEC_ADS_READ_PROP - all possible scopes and basedns This demonstrates that NO_SUCH_OBJECT doesn't depend purely on the visibility of the base dn, it's still possible to get children returned und an invisible base dn. It also demonstrates the additional behavior with "List Object" mode. See [MS-ADTS] 5.1.3.3.6 Checking Object Visibility BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-10-02python2 reduction: Merge remaining compat code into commonDavid Mulder7-12/+12
The remaining compat code (get_string, get_bytes, cmp) are useful helper routines which we should simply merge into common (especially since there is some duplication here). Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Fri Oct 2 14:49:36 UTC 2020 on sn-devel-184
2020-08-24tests/vlv: attempt to cause trouble by changing sort attributeDouglas Bagnall1-0/+23
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-08-24tests/vlv: remove redundant assignmentsDouglas Bagnall1-3/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-08-11python compat: remove text_typeDouglas Bagnall2-4/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-07-02CVE-2020-10760 dsdb: Add tests for paged_results and VLV over the Global ↵Andrew Bartlett1-65/+106
Catalog port This should avoid a regression. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-07-02CVE-2020-10730: selftest: Add test to show that VLV and paged_results are ↵Andrew Bartlett2-0/+50
incompatible As tested against Windows Server 1709 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14364 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-07-02CVE-2020-10730: selftest: Add test to confirm VLV interaction with ASQAndrew Bartlett1-0/+27
Tested against Windows 1709. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14364 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-05-04CVE-2020-10700: dsdb: Add test for ASQ and ASQ in combination with paged_resultsAndrew Bartlett1-0/+171
Thanks to Andrei Popa <andrei.popa@next-gen.ro> for finding, reporting and working with us to diagnose this issue! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-03-22dsdb: Add test for the case of a link pointing back at its own objectAndrew Bartlett1-0/+25
This type of object was not possible to delete in Samba without first removing the link. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14306 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-07pytests: heed assertEquals deprecation warning en-masseDouglas Bagnall20-920/+920
TestCase.assertEquals() is an alias for TestCase.assertEqual() and has been deprecated since Python 2.7. When we run our tests with in python developer mode (`PYTHONDEVMODE=1 make test`) we get 580 DeprecationWarnings about this. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2019-10-31CVE-2019-14847 dsdb: Demonstrate the correct interaction of ranged_results ↵Andrew Bartlett1-0/+26
style attributes and dirsync Incremental results are provided by a flag on the dirsync control, not by changing the attribute name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-10-24s4:tests/dirsync: add tests for dirsync with extended_dnStefan Metzmacher1-0/+31
This demonstrates a problems that the extended_dn returned by the dirsync module always uses the SDDL format for GUID/SID components. Azure AD connect reports discovery errors: reference-value-not-ldap-conformant for attributes member and manager. The key is that it sends the LDAP_SERVER_EXTENDED_DN_OID without an ExtendedDNRequestValue blob, which means the flag value should be treated as 0 and the HEX string format should be used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14153 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-09-20librpc/idl: change from samr_GroupAttrs in samr.idl to security_GroupAttrs ↵Stefan Metzmacher1-1/+1
in security.idl Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2019-09-01Spelling fixes s/recieved/received/Mathieu Parent1-3/+3
Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-08-30paged results: tests without server_sort ctrlAaron Haslett1-14/+40
On windows, adding or modifying a record during a paged results search behaves differently depending on whether or not you supply server_sort control. This patch adds tests and documentation. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Aug 30 08:26:21 UTC 2019 on sn-devel-184
2019-07-02s4/tests/dsdb_schema: not usefully executable as scriptDouglas Bagnall1-1/+0
You could run the script, but it wouldn't do anything. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-19CVE-2019-12436 dsdb/paged_results: ignore successful results without messagesDouglas Bagnall1-1/+49
So that we don't dereference result->msgs[0] when it doesn't exist. This can happen when the object has changed in such a way that it no longer matches the original search query. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13951 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Wed Jun 19 08:16:39 UTC 2019 on sn-devel-184
2019-05-20selftest: Remove gensec.FEATURE_SEAL from samba4.ldap.notificationAndrew Bartlett1-1/+0
This made it much harder to watch under wireshark and is not required (no password setting). Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20dsdb: Add random values to names in tests for large LDAP responsesAndrew Bartlett1-2/+2
This test is run agianst multiple DCs in the same domain, so there can be a race with replication. Therefore avoid using the same name twice by adding a random suffix. This is an improvement to a demonstrator for this bug in TDB: BUG: https://bugzilla.samba.org/show_bug.cgi?id=13952 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-17dsdb: Add tests for large LDAP responsesAndrew Bartlett1-0/+256
This behaviour is Samba-specific, we have not traditionally cut of responses at 1000 or so as Windows does, and we need to change that behaviour carefully. This triggers this bug in TDB: BUG: https://bugzilla.samba.org/show_bug.cgi?id=13952 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-05-06selftest: correcting empty attribute usage in requestsAaron Haslett1-1/+1
Many parts of Samba use an empty attribute list in requests expecting all attributes to be returned in the response, which is incorrect. This patch corrects the instances found by current CI tests. Static analysis and debugging will need to be done before changing ildap to the correct semantics. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Mon May 6 05:45:55 UTC 2019 on sn-devel-184
2019-05-06ldap: test for empty attributes listAaron Haslett1-0/+17
Test for LDAP request with an empty attribute list. LDB responds with no attributes, but LDAP responds with all attributes. Fix is attached to the bug below but we can't push it upstream until we've found all instances of incorrect empty attribute list usage in Samba. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13852 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01pytests: try ldap.modify_order with normal userDouglas Bagnall14-17/+3802
We run the tests again, trying to modify as a normal user rather than Administrator. It turns out that we do not always return the same error code as Windows, but in all these tests both Windows and Samba always return some kind of error (as you might hope). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01dsdb pytests: test the effect of reordering modify requestsDouglas Bagnall14-0/+4294
Do we interpret these the same way as Windows? In many cases, no. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01dsdb/pytest/ldap: use idiomatic 'e' for exceptionsDouglas Bagnall1-218/+218
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01dsdb/pytest/ldap: revive commented out test for attr size rangeDouglas Bagnall1-21/+32
The test was presumably commented out because we fail it, and known-failing it would have hidden the attr-too-short tests that it was bundled with. If we disentangle them we can knwn-fail it, which serves as a TODO list. (passes against WIN2012R2). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-11samdb: test for schemainfo update with relax controlAaron Haslett1-4/+11
Currently schema info's revision field isn't incremented if relax control is present. This is so that no increment is done during provision, but we need the relax control in other situations where the increment is desired. This patch adds a failing test to expose the problem. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13799 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-04-02Spelling fix s/informations/information/Mathieu Parent5-8/+8
Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-03-29paged_search: perf testing paged searchAaron Haslett1-2/+9
Adding medley performance run with paged search module. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13836 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04dsdb pytsts: reduce scale of subtree rename speed testDouglas Bagnall1-1/+1
The speed test, when it was introduced a few patches ago, was deliberately slow so that we could see how much better the changes were. It used 500 users, 50 groups, and 27 computers. Before the changes, it took this long: rename ou took 64.373s rename group took 0.160s rename user took 0.004s rename computer took 0.123s After using the sorted links, it took this long: rename ou took 12.984s rename group took 0.161s rename user took 0.004s rename computer took 0.122s And with the final patch to stop the linear search early on success: rename ou took 11.680s rename group took 0.089s rename user took 0.004s rename computer took 0.128s "rename ou" is the one we were aiming at. Now that we have done that, we reduce the size of the test so as not to slow down everyone's autobuilds. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 06:46:42 +0000