summaryrefslogtreecommitdiff
path: root/testprogs
AgeCommit message (Collapse)AuthorFilesLines
2025-10-21CVE-2025-10230: s4/tests: check that wins hook sanitizes namesDouglas Bagnall1-0/+15
An smb.conf can contain a 'wins hook' parameter, which names a script to run when a WINS name is changed. The man page says The second argument is the NetBIOS name. If the name is not a legal name then the wins hook is not called. Legal names contain only letters, digits, hyphens, underscores and periods. but it turns out the legality check is not performed if the WINS server in question is the source4 nbt one. It is not expected that people will run this server, but they can. This is bad because the name is passed unescaped into a shell command line, allowing command injection. For this test we don't care whether the WINS server is returning an error code, just whether it is running the wins hook. The tests show it often runs the hook it shouldn't, though some characters are incidentally blocked because the name has to fit in a DN before it gets to the hook, and DNs have a few syntactic restrictions (e.g., blocking '<', '>', and ';'). The source3 WINS server that is used by Samba when not run as a DC is not affected and not here tested. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15903 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-10-16tests: Run `dd` without any preloaded librariesAndreas Schneider5-5/+5
If AddressSanitizer is loaded it will detect alignment issues. The tool is not ours, so ignore it. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Thu Oct 16 09:34:58 UTC 2025 on atb-devel-224
2025-09-05tests: Add test for 'net ads join' to a preferred DCPavel Filipenský1-0/+61
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-08-27schema: Add Validated-Write-Computer Extended Right from Windows Server 2016Jennifer Sutton2-0/+6
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-10tests: Replace PREFIX_ABS with PREFIXPavel Filipenský17-296/+298
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-04-15lib:cmdline: POPT_CALLBACK_REASON_POST should handle if we skip the password ↵Andreas Schneider1-1/+1
callback It is already checking if there is a valid ccache and disabling the callback. In case of IAKerb we specify a ccache but might to fill one with a krbtgt. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Apr 15 12:54:57 UTC 2025 on atb-devel-224
2025-04-11testprogs: Use 'sync machine password to keytab' for keytab creationAndreas Schneider1-1/+3
We want to get rid of dedicatedkeytabfile for writing keytabs. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Apr 11 08:38:49 UTC 2025 on atb-devel-224
2025-04-11testprogs: Remove dead codeAndreas Schneider1-17/+0
The test for this has been removed already, this is just leftover. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2025-04-11s3:net: 'net ads keytab list' should only list default keytabAndreas Schneider1-3/+8
If you don't specify a keytab, assume we just want the default keytab. This will make upcoming changes to the code easier. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2025-01-30selfest: add test for non-local offlinejoin provisionGünther Deschner1-0/+14
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15777 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-01-13testprogs/blackbox: let test_rpcclient_schannel.sh explicitly use ↵Stefan Metzmacher1-9/+42
--option=clientusekrb5netlogon This also tests lsa over kerberos Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2024-11-06s4: s/the the\b/the/ in miscellaneous commentsDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Volker Lendecke <vl@samba.org>
2024-07-26testprogs: Remove alias test from test_net_ads.shPavel Filipenský1-1/+0
"net ads keytab create" no longer reads msDS-AdditionalDnsHostName from AD BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26testprogs: Remove dnshostname related test from test_net_ads.shPavel Filipenský1-15/+0
"net ads keytab create" no longer reads dNSHostName from AD BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26testprogs: Use "HOST' instead of 'host' in test_net_ads.shPavel Filipenský1-2/+2
"net ads keytab create" will uses the same value as in AD, modifications to lower case are no longer done BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26testprogs: Remove upn related test from test_net_ads.shPavel Filipenský1-17/+0
"net ads keytab create" will no longer read "userPrincipalName" from AD BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26testprogs: Remove "keytab add", "keytab delete" and "keytab add_apdate_ads" ↵Pavel Filipenský1-126/+0
related tests from test_net_ads.sh "net ads" will no longer support "keytab add", "keytab delete" and "keytab add_apdate_ads" BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-06-19testprogs/blackbox: add test_ldap_token.sh to test "client use kerberos" and ↵Stefan Metzmacher1-0/+115
--use-kerberos This shows that they are ignored for machine accounts as domain member. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15666 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-06-19testprogs/blackbox: let test_trust_token.sh check for S-1-18-1 with kerberosStefan Metzmacher1-2/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15666 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-22test_kinit_export_keytab: reset pw of the test account and test ↵Stefan Metzmacher1-7/+15
--only-current-keys Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 22 04:07:02 UTC 2024 on atb-devel-224
2024-05-14s3:libads: let ads_sasl_spnego_bind() really use spnego to negotiate ↵Stefan Metzmacher1-1/+1
krb5/ntlmssp For now we still do the ads_kinit_password() in ads_legacy_creds() for callers that rely on the global krb5ccache to be filled. E.g. the dns update code and the kpasswd code. But at least ads_connect_internal() and ads_sasl_spnego_bind() will allow to do the kinit in the gensec layer only if needed... We'll remove ads_legacy_creds() during the following commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14testprogs/blackbox: add better testnames in test_weak_disable_ntlmssp_ldap.shStefan Metzmacher1-4/+7
This makes it easier to adjust the expected output when it changes in the next commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14blackbox/test_kinit.sh: verify that --use-krb5-ccache= works without KRB5CCNAMEStefan Metzmacher1-31/+70
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-04-23blackbox/test_net_ads_search_server: also test ldaps/starttlsStefan Metzmacher1-0/+42
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-14samba-tool domain exportkeytab: Refuse to overwrite an existing file in ↵Andrew Bartlett1-0/+1
full-db export Since 87f67d336919172845f53067c67d1eab8e7ef18a samba-tool domain exportkeytab has silently unlinked the given target file. Instead, the administrator now needs to specify a file that does not exist. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-01selftest: Ignore msKds-DomainID in ldapcmp_restoredc.sh and ↵Andrew Bartlett1-0/+6
samba.tests.domain_backup_offline Like serverReferenceBL etc, this will point to a DC that created the object, and as part of the backup and restore, this DC will be deleted. It is just for tracking the object creation, so this is fine. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-02-16testprogs:blackbox: Fix code spellingJo Sutton1-4/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16CVE-2018-14628: python:descriptor: let samba-tool dbcheck fix the ↵Stefan Metzmacher1-0/+12
nTSecurityDescriptor on CN=Deleted Objects containers BUG: https://bugzilla.samba.org/show_bug.cgi?id=13595 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14testprogs: Fix script usage linesJoseph Sutton13-13/+13
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14nsswitch: add test for pthread_key_delete missuse (bug 15464)Stefan Metzmacher1-0/+21
This is based on https://bugzilla.samba.org/attachment.cgi?id=18081 written by Krzysztof Piotr Oledzki <ole@ans.pl> BUG: https://bugzilla.samba.org/show_bug.cgi?id=15464 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-09-05testprogs: Add net offlinejoin composeodj testsSamuel Cabrero1-0/+88
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13577 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Sep 5 22:11:46 UTC 2023 on atb-devel-224
2023-09-05testprogs: Cleanup machine account in net offlinejoin testsSamuel Cabrero1-0/+6
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13577 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14testprogs: Fix code spellingAndreas Schneider4-5/+5
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08testprogs: Fix code spellingJoseph Sutton2-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-25testprogs/blackbox: add test_ldap_tls_reload.shJule Anger1-0/+64
This tests the reload (and if needed regeneration) of tls certificates. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Jule Anger <janger@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-22testprogs/blackbox: add --recursive tests to test_samba-tool_ntacl.shStefan Metzmacher1-3/+135
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jun 22 00:22:47 UTC 2023 on atb-devel-224
2023-06-21testprogs/blackbox: move 'ntacl get' out of test_changedomsid() in ↵Stefan Metzmacher1-10/+9
test_samba-tool_ntacl.sh Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21testprogs/blackbox: pass $CONFIGURATION to test_samba-tool_ntacl.shStefan Metzmacher1-8/+9
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21testprogs/blackbox: also raise the levels to 2012_R2/2016 in functionalprep.shStefan Metzmacher1-0/+21
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21testprogs/blackbox: also prepare for to 2016 (schema=2019) in functionalprep.shStefan Metzmacher1-4/+16
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs: Do not export UID_WRAPPER_ROOT in test_kpasswd_heimdal.shAndreas Schneider1-3/+0
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs: Do not export UID_WRAPPER_ROOT in test_kpasswd_mit.shAndreas Schneider1-3/+0
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs: Do not export UID_WRAPPER_ROOT in test_pdbtest.shAndreas Schneider1-3/+0
We already set root for smbpasswd. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs: Do not export UID_WRAPPER_ROOT in test_net_ads_dns.shAndreas Schneider1-3/+0
There is not need for root here. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs: Do not export UID_WRAPPER_ROOT in test_samba-tool_ntacl.shAndreas Schneider1-3/+0
There is not need for root here. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs:subunit: Fix integer comparisonsAndreas Schneider1-8/+8
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-16testprogs:subunit: Fix assigning an array to a stringAndreas Schneider1-5/+5
$@ is an array and we want a string. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-13testprogs: Add test_alias_membershipPavel Filipenský1-0/+194
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-28s3/utils: when encoding ace string use "FA", "FR", "FW", "FX" string rightsNoel Power1-5/+3
prior to this patch rights matching "FA", "FR", "FW", "FX" were outputted as the hex string representing the bit value. While outputting the hex string is perfectly fine, it makes it harder to compare icacls output (which always uses the special string values) Additionally adjust various tests to deal with use of shortcut access masks as sddl format now uses FA, FR, FW & FX strings (like icalcs does) instead of hex representation of the bit mask. adjust samba4.blackbox.samba-tool_ntacl samba3.blackbox.large_acl samba.tests.samba_tool.ntacl samba.tests.ntacls samba.tests.posixacl so various string comparisons of the sddl format now pass Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> [abartlet@samba.org Adapted to new stricter SDDL behaviour around leading zeros in hex numbers, eg 0x001]
2023-04-28test:bb/samba-tool ntacl: let return acl flag lack hex paddingDouglas Bagnall1-5/+10
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 23:09:40 +0000