sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code
127,868 Commits 60 Branches 1,144 Tags 452 MiB
73a4806346
Commit Graph

3194 Commits

Author SHA1 Message Date
Joseph Sutton
2158ba1eb0 CVE-2020-25719 tests/krb5: Extend _get_tgt() method to allow more modifications to tickets 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
e647186c14 CVE-2020-25719 tests/krb5: tests/krb5: Adjust expected error code for S4U2Self no-PAC tests 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
924f323188 CVE-2020-25719 tests/krb5: Adjust expected error codes for user-to-user tests 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14873

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
faf47b0b6b CVE-2020-25719 tests/krb5: Adjust PAC tests to prepare for new PAC_ATTRIBUTES_INFO buffer 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
a236e2cc25 CVE-2020-25719 tests/krb5: Use correct credentials for user-to-user tests 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14873

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
9602594585 CVE-2020-25719 tests/krb5: Return ticket from _tgs_req() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
21298ddfc5 CVE-2020-25719 tests/krb5: Expect 'renew-till' element when renewing a TGT 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
383bedd6fd CVE-2020-25719 tests/krb5: Don't expect a kvno for user-to-user 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14873

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
dd251f26df CVE-2020-25719 tests/krb5: Allow update_pac_checksums=True if the PAC is not present 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
336dfc3207 CVE-2020-25719 tests/krb5: Provide expected parameters for both AS-REQs in get_tgt() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Joseph Sutton
2249143fe3 CVE-2020-25718 tests/krb5: Fix indentation 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Douglas Bagnall
11540375af CVE-2020-25722 pytest: test setting servicePrincipalName over ldap 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Douglas Bagnall
df34c11cbc CVE-2020-25722 pytest: test sAMAccountName/userPrincipalName over ldap 
Because the sam account name + the dns host name is used as the
default user principal name, we need to check for collisions between
these. Fixes are coming in upcoming patches.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Douglas Bagnall
72a2c21f3f CVE-2020-25722 samba-tool spn add: remove --force option 
This did not actually *force* the creation of a duplicate SPN, it just
ignored the client-side check for the existing copy. Soon we are going
to enforce SPN uniqueness on the server side, and this --force will not
work. This will make the --force test fail, and if that tests fail, so
will others that depend the duplicate values. So we remove those tests.

It is wrong-headed to try to make duplicate SPNs in any case, which is
probably why there is no sign of anyone ever having used this option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Douglas Bagnall
7243bd7d38 CVE-2020-25722 samba-tool spn: accept -H for database url 
Following the convention and making testing easier

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Douglas Bagnall
b919246c55 CVE-2020-25722 pytest: assertRaisesLdbError invents a message if you're lazy 
This makes it easier to convert tests that don't have good messages.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Douglas Bagnall
de24916a82 CVE-2020-25722 pytests: add reverse lookup dict for LDB error codes 
You can give ldb_err() it a number, an LdbError, or a sequence of
numbers, and it will return the corresponding strings. Examples:

ldb_err(68)       # "LDB_ERR_ENTRY_ALREADY_EXISTS"
LDB_ERR_LUT[68]   # "LDB_ERR_ENTRY_ALREADY_EXISTS"

expected = (ldb.ERR_INSUFFICIENT_ACCESS_RIGHTS,
            ldb.ERR_INVALID_CREDENTIALS)
try:
    foo()
except ldb.LdbError as e:
    self.fail(f"got {ldb_err(e)}, expected one of {ldb_err(expected)}")

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:33 +00:00
Samuel Cabrero
14b9f905da CVE-2020-25717: selftest: Add a test for the new 'min domain uid' parameter 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

[abartlet@samba.org Fixed knowfail per instruction from metze]
 2021-11-09 19:45:33 +00:00
Joseph Sutton
b4ea50f8b2 CVE-2020-25719 CVE-2020-25717 tests/krb5: Adapt tests for connecting without a PAC to new error codes 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Stefan Metzmacher
9fe1b719e1 CVE-2020-25719 CVE-2020-25717 tests/krb5: Add tests for connecting to services anonymously and without a PAC 
At the end of the patchset we assume NT_STATUS_NO_IMPERSONATION_TOKEN if
no PAC is available.

For now we want to look for ACCESS_DENIED as this allows
the test to pass (showing that gensec:require_pac = true
is a useful partial mitigation).

This will also help others doing backports that do not
take the full patch set.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
903ab1a027 CVE-2020-25721 tests/krb5: Add tests for extended PAC_UPN_DNS_INFO PAC buffer 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14835

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
24be204834 CVE-2020-25719 tests/krb5: Add tests for including authdata without a PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
3af0c36a06 CVE-2020-25718 tests/krb5: Add tests for RODC-printed and invalid TGTs 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
7f7476b08c CVE-2020-25719 tests/krb5: Add principal aliasing test 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
48e5154de6 CVE-2020-25719 tests/krb5: Add a test for making an S4U2Self request without a PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
bd87905cf1 CVE-2020-25719 tests/krb5: Add tests for requiring and issuing a PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
3f7b971d37 CVE-2020-25721 ndrdump: Add tests for PAC with UPN_DNS_INFO 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14835

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
89c88a83da CVE-2020-25722 tests/krb5: Add KDC tests for 3-part SPNs 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14776

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
4125650a27 CVE-2020-25719 CVE-2020-25717 tests/krb5: Allow create_ccache_with_user() to return a ticket without a PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
873ac6d814 CVE-2020-25719 CVE-2020-25717 tests/krb5: Refactor create_ccache_with_user() to take credentials of target service 
This allows us to use get_tgt() and get_service_ticket() to obtain
tickets, which simplifies the logic.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
23dc0cbd53 CVE-2020-25721 tests/krb5: Check PAC buffer types when STRICT_CHECKING=0 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14835

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
4ac05264a7 MS CVE-2020-17049 tests/krb5: Allow tests to pass if ticket signature checksum type is wrong 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
dbedf5b6e2 CVE-2020-25719 tests/krb5: Add method to get unique username for test accounts 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
4a792ad92d CVE-2020-25719 tests/krb5: Add is_tgt() helper method 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
43df8d0b2e CVE-2020-25722 tests/krb5: Allow creating server accounts 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14776

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
06168fd4e3 CVE-2020-25719 CVE-2020-25717 tests/krb5: Add pac_request parameter to get_service_ticket() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
ff6631ecdc CVE-2020-25719 CVE-2020-25717 tests/krb5: Modify get_service_ticket() to use _generic_kdc_exchange() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Joseph Sutton
f7f49db722 CVE-2020-25718 tests/krb5: Allow tests accounts to replicate to RODC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-11-09 19:45:32 +00:00
Andrew Bartlett
adfae12584 CVE-2020-25722 selftest: Allow self.assertRaisesLdbError() to take a list of errors to match with 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-11-09 19:45:32 +00:00
David Mulder
1fce72f796 samba-tool: Add domain member leave 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>

Autobuild-User(master): David Mulder <dmulder@samba.org>
Autobuild-Date(master): Thu Nov  4 20:43:32 UTC 2021 on sn-devel-184
 2021-11-04 20:43:32 +00:00
David Mulder
5199eb1412 gp: Apply Firewalld Policy 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Nov  1 21:16:43 UTC 2021 on sn-devel-184
 2021-11-01 21:16:43 +00:00
David Mulder
cd73e41013 gp: Test Firewalld Group Policy Apply 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2021-11-01 20:29:36 +00:00
David Mulder
2be0a19d44 Revert "samba-tool: Pick local host if calling samba-tool from DC" 
This reverts commit 7c9195e28b.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): David Mulder <dmulder@samba.org>
Autobuild-Date(master): Tue Oct 26 16:00:28 UTC 2021 on sn-devel-184
 2021-10-26 16:00:28 +00:00
David Mulder
7c9195e28b samba-tool: Pick local host if calling samba-tool from DC 
It is reasonable to assume, that if we are running a command from a DC,
that a user expects that the command will run against this DC.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>

Autobuild-User(master): David Mulder <dmulder@samba.org>
Autobuild-Date(master): Tue Oct 26 14:23:42 UTC 2021 on sn-devel-184
 2021-10-26 14:23:42 +00:00
Andreas Schneider
db34188246 Revert "gp: Test Firewalld Group Policy Apply" 
This reverts commit 8f34744919.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: David Mulder <dmulder@suse.com>
 2021-10-25 14:08:32 +00:00
Andreas Schneider
cd5f519913 Revert "gp: Apply Firewalld Policy" 
This reverts commit 9ac2d5d991.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: David Mulder <dmulder@suse.com>
 2021-10-25 14:08:32 +00:00
Joseph Sutton
c174e9ebe7 tests/krb5: Check account name and SID in PAC for S4U tests 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Oct 25 09:23:35 UTC 2021 on sn-devel-184
 2021-10-25 09:23:35 +00:00
David Mulder
9ac2d5d991 gp: Apply Firewalld Policy 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
 2021-10-25 08:31:31 +00:00
David Mulder
8f34744919 gp: Test Firewalld Group Policy Apply 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
 2021-10-25 08:31:31 +00:00
Joseph Sutton
46039baa81 tests/krb5: Add tests for account salt calculation 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
25bdf4c994 tests/krb5: Fix account salt calculation to match Windows 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
889476d175 tests/krb5: Allow specifying the UPN for test accounts 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
f4785ccfef tests/krb5: Allow creating machine accounts without a trailing dollar 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
7e39994ed3 tests/krb5: Allow specifying prefix or suffix for test account names 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
a5a6296e57 tests/krb5: Decrease length of test account prefix 
This allows us more room to test with different account names.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Douglas Bagnall
d4a75eead0 pytest: s3_net_join: avoid name clash 
The net_join test uses "NetJoinTest" (and doesn't properly clean up),
we must use a unique name for this test in s3_net_join.py.

[abartlet@samba.org The hilarious naming conventions come from a time when samba-tool
was known as "net" in the s4 branch]

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
49306f74eb selftest: krb5 account creation: clarify account type as an enum 
This makes the code clearer with a symbolic constant rather
than a True/False boolean.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Douglas Bagnall
aacb18f920 pytest: dynamic tests optionally add __doc__ 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 12:02:33 +00:00
Joseph Sutton
83a654a4ef tests/krb5: Add tests for constrained delegation to NO_AUTH_DATA_REQUIRED service 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct 20 09:22:43 UTC 2021 on sn-devel-184
 2021-10-20 09:22:43 +00:00
Joseph Sutton
cc3d27596b tests/krb5: Ensure PAC is not present if expect_pac is false 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-10-20 08:31:31 +00:00
Joseph Sutton
9d3a691920 tests/krb5: Add tests for requesting a service ticket without a PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Oct 17 23:40:33 UTC 2021 on sn-devel-184
 2021-10-17 23:40:33 +00:00
Joseph Sutton
288355896a tests/krb5: Add method to get the PAC from a ticket 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-17 22:53:37 +00:00
Joseph Sutton
0dc69c1327 tests/krb5: Allow specifying whether to expect a PAC with _test_as_exchange() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-17 22:53:37 +00:00
Joseph Sutton
e086c6193f tests/krb5: Allow get_tgt() to request including or omitting a PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-17 22:53:37 +00:00
Joseph Sutton
3dede18c5a tests/krb5: Fix duplicate account creation 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
3948701f1d tests/krb5: Allow bypassing cache when creating accounts 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
1a08399cd8 tests/krb5: Don't include empty AD-IF-RELEVANT 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
56ccdba54e tests/krb5: Add constrained delegation tests 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
d86eee2fd0 tests/krb5: Verify tickets obtained with get_service_ticket() 
We only require the ticket checksum with Heimdal, because MIT currently
doesn't add it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
bf63221722 tests/krb5: Require ticket checksums if decryption key is available 
We perform this check conditionally, because MIT doesn't currently add
ticket checksums.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ae2c57fb03 tests/krb5: Add TKT_SIG_SUPPORT environment variable 
This lets us indicate that service tickets should be issued with ticket
checksums in the PAC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ebe7297868 tests/krb5: Fix sha1 checksum type 
Previously, sha1 signatures were being designated as rsa-md5-des3
signatures.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
5233f00200 tests/krb5: Provide clearer assertion messages for test failures 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
dfd613661e tests/krb5: Disable debugging output for tests 
This reduces the time spent running the tests in a testenv.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
cf3ca6ac45 tests/krb5: Simplify padata checking 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
e7c39cc44f tests/krb5: Check logon name in PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
bd22dcd9cc tests/krb5: Check padata types when STRICT_CHECKING=0 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
238f52bad8 tests/krb5: Add environment variable to specify KDC FAST support 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
72265227e9 tests/krb5: Fix padata checking at functional level 2003 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ee2b7e2c77 tests/krb5: Clarify checksum type assertion message 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
687c8f94c6 tests/krb5: Use correct principal name type 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ec4b264bdf tests/krb5: Add compatability tests for ticket checksums 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ef24fe982d tests/krb5: Add parameter to enforce presence of ticket checksums 
This allows existing tests to pass before this functionality is
implemented.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
248249dc0a tests/krb5: Supply supported account enctypes in tgs_req() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
34020766bb tests/krb5: Allow specifying options and expected flags when obtaining a ticket 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
bb58b4b58c tests/krb5: Save account SPN 
This is useful for testing delegation.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
0e232fa1c9 tests/krb5: Check constrained delegation PAC buffer 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
aa2e583fde tests/krb5: Check buffer types in PAC with STRICT_CHECKING=1 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
7cfc225b54 tests/krb5: Add expect_claims parameter to kdc_exchange_dict 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ab92dc16d2 tests/krb5: Fix checking for presence of error data 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
7fba83c6c6 tests/krb5: Remove unneeded parameters from ticket cache key 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
788b3a29ee tests/krb5: Fix assertElementFlags() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
8f6d369d70 tests/krb5: Make expected_sname checking more explicit 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
012b6fcd19 tests/krb5: Fix status code checking 
The type used to encode the status code is actually KERB-ERROR-DATA,
rather than PA-DATA.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
a4bc712ee0 tests/krb5: Fix handling authdata with missing PAC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
dcf45a151a tests/krb5: Allow excluding the PAC server checksum 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
a927cecafd tests/krb5: Fix checksum generation and verification 
The KDC and server checksums may be generated using the same key, but
only the KDC checksum should have an RODCIdentifier. To fix this,
instead of overriding the existing methods, add additional ones for
RODC-specific signatures, so that both types of signatures can be
generated or verified.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
ae09219c3a tests/krb5: Fix method for creating invalid length zeroed checksum 
Previously the base class method was being used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
9d142dc3a4 tests/krb5: Introduce helper method for creating invalid length checksums 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00
Joseph Sutton
cda50b5c50 tests/krb5: Add assertion to make failures clearer 
These failures may occur if tests are not run against an RODC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-10-14 18:59:31 +00:00