sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code
137,562 Commits 60 Branches 1,144 Tags 452 MiB
1889e0aea3
Commit Graph

4902 Commits

Author SHA1 Message Date
Jo Sutton
1889e0aea3 python: Move get_admin_sid() to SamDB 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-24 05:16:29 +00:00
Jo Sutton
103ca0276f tests/krb5: Check that updated NT hashes of gMSAs have the values we expect 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-24 05:16:29 +00:00
Stefan Metzmacher
6c17e3d280 s4:ldap_server: add support for tls channel bindings 
ldap server require strong auth = allow_sasl_over_tls
is now an alias for 'allow_sasl_without_tls_channel_bindings'
and should be avoided and changed to 'yes' or
'allow_sasl_without_tls_channel_bindings'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-23 23:50:34 +00:00
Stefan Metzmacher
96e4a92f19 tests/segfault.py: make sure samdb.connect(url) has a valid lp_ctx 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-23 23:50:33 +00:00
Stefan Metzmacher
aff2932c42 python/samba/getopt: don't prompt for a password for --use-krb5-ccache=... 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15018

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2024-04-23 14:17:32 +00:00
Jo Sutton
20ce68f159 tests/krb5: Test retrieving a denied gMSA password over an unsealed connection 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Jo Sutton <jsutton@samba.org>
Autobuild-Date(master): Sun Apr 21 23:17:53 UTC 2024 on atb-devel-224
 2024-04-21 23:17:53 +00:00
Jo Sutton
c6fec5156f tests/krb5: Note that lockout tests use password checks 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
ed371ff0fa tests/krb5: Fix malapropism 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
8dca32eba2 pyglue: Remove unnecessary declaration 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
56dd910b83 python: Reformat code 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
1b765edbc9 tests/krb5: Add tests that gMSA keys are updated in the database when appropriate 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
47c519af8e tests/krb5: Import MAX_CLOCK_SKEW more directly 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
21d46f3ece tests/krb5: Extract method to unpack supplementalCredentials blob 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:36 +00:00
Jo Sutton
502070cd9a tests/krb5: Skip loop iteration if attribute has no values 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-21 22:10:35 +00:00
Andreas Schneider
7a5e7b8212 python: Fix NtVer check for site_dn_for_machine() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15633

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Apr 17 19:32:11 UTC 2024 on atb-devel-224
 2024-04-17 19:32:11 +00:00
Jo Sutton
be0029cff4 python:tests: Catch failures to authenticate with gMSA managed passwords 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
bb5ca9f466 tests/krb5: Add tests for gMSAs 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
42710f0455 python:nt_time: Add NT_TIME_MAX constant 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
c6ed19ad1a python:gkdi: Reformat code with ‘ruff’ 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
5aaebb537e python:gkdi: Add Gkdi.from_key_envelope() method 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
0c0a25d0b2 python:gkdi: Add notes on GKDI time periods 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
1381581334 tests/gkdi: Change ‘current_gkid’ parameter to ‘current_time’ 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
b64a02d5b5 tests/gkdi: Remove implicit clock skew offset 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
13dcf7f74c tests/gkdi: Allow current time to be overridden 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
6d20d436de tests/krb5: Make use of ‘expect_edata’ parameter 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
1f4e1c026d tests/krb5: Remove unused variable 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
586c4ec718 tests/krb5: Fix code spelling 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
5656fd2ff2 tests/krb5: Remove unused import 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
4b6f65a4a2 python:tests: Fix typo 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
5379956bd4 python:tests: Reformat code 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
ae39a15b51 python:tests: Fix set declaration 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Jo Sutton
ea83bb84b9 python:tests: Replace deprecated method assertRaisesRegexp() 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-16 03:58:31 +00:00
Andrew Bartlett
c9370d3ced selftest: Move some KDS root key tests around to prepare for gMSA server side 
Once we have a gMSA server side the impact of deleting root keys becomes real
and so we must do this in a quiet place where it can not impact on other things.

Likewise, we want the samba.tests.dsdb_quiet_provision_tests tests to run
somewhere that is not doing other things, so we can see what a bare provision
will do.  We must not allow test ordering inside the file to cause tests that
create root keys to run before checking if provision created a usable root key.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
 2024-04-16 03:58:31 +00:00
Andrew Bartlett
bda4e1233a ldb: Add more segfault tests DN handling 
- from_dict DN use-after-free
- check for the same directly creating the ldb.Message

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2024-04-10 05:13:32 +00:00
Douglas Bagnall
d38a9e93cf python:upgrade/upgradeprovision: use dn.copy to align ldbs 
We need to do this when the dn is on a message from another ldb.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-10 05:13:32 +00:00
Douglas Bagnall
8bb6287c3b pytest:segfault: some more ldb crashes 
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-10 05:13:32 +00:00
Andrew Bartlett
0bf80c10ca samba-tool domain backup: Use new ldb.disconnect() method to force-close files during backup 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2024-04-10 05:13:32 +00:00
Andrew Bartlett
ffbe623963 selftest: Add tests that demonstrate the issues with ldb use after free 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2024-04-10 05:13:32 +00:00
Douglas Bagnall
3ffc6c139b pytest:krb5/lockout: associate user DN with the ldb it is used with 
LDB is soon going to object strongly to Python DNs that don't come from
the ldb that they are being used with, for memory safety reasons.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-10 05:13:32 +00:00
Andrew Bartlett
dbba6c22a4 auth/credentials: Read managed_password.passwords.query_interval only after parsing 
The code previously read the uninitialised stack not the parsed
structure, and so could segfault if the stack was not zero.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Apr  9 23:59:54 UTC 2024 on atb-devel-224
 2024-04-09 23:59:54 +00:00
Andrew Bartlett
005ce15aab python/samba/tests: Fix gMSA blackbox test to expect failure to get password after membership change 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2024-04-09 22:52:38 +00:00
Andreas Schneider
2d60d1b96a python: Use OpenPolicyFallback() in trust.py 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:38 +00:00
Andreas Schneider
859e7f8c5f python: Implement CreateTrustedDomainFallback() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
812d4e0d6c python: Add aead_aes_256_cbc_hmac_sha512() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
23e61d2ceb python: Use secrets.token_bytes instead of random 
random should not be used to create secure random numbers for tokens.
The secrets module is exactly for this.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
decacb0e7e python: Set parameter types for CreateTrustedDomainRelax() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
9e5fc81564 python:tests: Clean lsa_utils.py code according to Python standards 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
e32be2ade4 python:tests: Rename createtrustrelax.py to lsa_utils.py 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
00ed209e48 python: Implement OpenPolicyFallback() 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00
Andreas Schneider
85d0ab38f7 python:samba: Rename trust_utils.py to lsa_utils.py 
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-04-09 22:52:37 +00:00