1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Commit Graph

1349 Commits

Author SHA1 Message Date
Isaac Boukris
9b302a57ff selftest: test forwardable flag in cross-realm tgt tickets
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-06-12 20:42:38 +00:00
Andreas Schneider
55cbdac15e selftest: Run some tests against ad_member_fips
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-05-18 14:43:40 +00:00
Isaac Boukris
8b5e764413 selftest: add python S4U2Self tests including unkeyed checksums
To test the CRC32 I reverted the unkeyed-checksum fix (43958af1)
and the weak-crypto fix (389d1b97). Note that the unkeyed-md5
still worked even with weak-crypto disabled, and that the
unkeyed-sha1 never worked but I left it anyway.

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri May 15 12:25:40 UTC 2020 on sn-devel-184
2020-05-15 12:25:40 +00:00
Andreas Schneider
ab70153c20 testprogs: Add 'net ads join' test for fips
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Thu May 14 14:27:26 UTC 2020 on sn-devel-184
2020-05-14 14:27:26 +00:00
Andrew Bartlett
5603d26770 CVE-2020-10700: dsdb: Add test for ASQ and ASQ in combination with paged_results
Thanks to Andrei Popa <andrei.popa@next-gen.ro> for finding,
reporting and working with us to diagnose this issue!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-05-04 08:19:41 +00:00
Gary Lockyer
5d6bcef4b4 CVE-2020-10704: ldapserver tests: Limit search request sizes
Add tests to ensure that overly long (> 256000 bytes) LDAP search
requests are rejected.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:32 +00:00
Gary Lockyer
b0832d2016 CVE-2020-10704: libcli ldap: test recursion depth in ldap_decode_filter_tree
Add tests to check that ASN.1 ldap requests with deeply nested elements
are rejected.  Previously there was no check on the on the depth of
nesting and excessive nesting could cause a stack overflow.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:32 +00:00
Andreas Schneider
a454c9cd42 testprogs: Add client kerberos test
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Apr 29 11:53:41 UTC 2020 on sn-devel-184
2020-04-29 11:53:41 +00:00
Volker Lendecke
833303b8bd torture: Test smbc_utimes()
Prove that smbc_utimes throws away the tv_nsec field

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-08 14:46:40 +00:00
Andreas Schneider
ff67642dc2 tests: Add test to check the server doesn't allow NTLM
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-04-08 13:02:40 +00:00
Noel Power
0463960488 s4/selftest: Move samba4.rpc.join tests to ad_dc_default_smb1
The following tests which fail when run against a test env that
doesn't support SMB1

samba4.rpc.join on ncacn_ip_tcp with bigendian(ad_dc_default)
samba4.rpc.join on ncacn_ip_tcp with seal,padcheck(ad_dc_default)
samba4.rpc.join on ncacn_ip_tcp with validate(ad_dc_default)
samba4.rpc.join on ncacn_np with bigendian(ad_dc_default)
samba4.rpc.join on ncacn_np with seal,padcheck(ad_dc_default)
samba4.rpc.join on ncacn_np with validate(ad_dc_default)
samba4.rpc.join on ncalrpc with bigendian(ad_dc_default:local)
samba4.rpc.join on ncalrpc with seal,padcheck(ad_dc_default:local)
samba4.rpc.join on ncalrpc with validate(ad_dc_default:local)

have been moved to ad_dc_default_smb1

results verified with

VALIDATE="validate" python3 source4/selftest/tests.py | grep "^samba4.rpc.join" | grep ad_dc_default | sort

corrosponding entries have been removed from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
e362ad23ee s4/selftest: Move samba4.ldap.passwordsettings to ad_dc_default_smb1
Test samba4.ldap.passwordsettings fails when run against test env that
doesn't support SMB1 so move to ad_dc_default_smb1

Note: no skip entries to be removed as tests are known failures

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
1553641724 s4/selftest: Move samba4.ldap.nested-search to ad_dc_default_smb1
Test samba4.ldap.nested-search fails when run against test env
that doesn't support SMB1 so move to ad_dc_default_smb1

Also remove entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
c83fafacbb s4/selftest: Modify samba4.blackbox.chgdcpass to use smbclient(s3)
Test was using smbclient4 but this fails when used in environments that
don't support SMB1. We use smbclient(s3) instead. There remains one
failure due to behaviour differences between the smbclients.

The behavioural changes are related not to SMB1/SMB2 but
commits d4ea637eb8 &
fce66b22ea

Perhaps we need to modify s3 smbclient in a similar way? This is however
something that deserves further discussion.

Move this failing part to a knownfail for the moment.

Also the corrosponding entry in skip_smb1_fail has been removed

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
aa688a8de6 s4/selftest: Move samba.tests.libsmb to nt4_dc_smb1
Also remove associated entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
572bc3e643 s4/selftest: Adjust samba4.blackbox.pkinit to use (s3) smbclient
samba4.blackbox.pkinit falls to pass in environments that don't support
SMB2 because of use (s4) smbclient4. Change test to use (s3) smbclient

Additionally a test within the test script test_kinit_trusts_heimdal.sh
explicitly uses smbclient4 which can't negotiate SMB1 in environments
that don't support it. Add knownfail to cater for this & also remove entry
from the skip file

Further reference the smbclient4 specific test is associated with
https://bugzilla.samba.org/show_bug.cgi?id=12554 so maybe we should
keep it for the moment

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:30 +00:00
Noel Power
4c92489383 s4/selftest: Move samba.tests.net_join_no_spnego to ad_dc_smb1
Test samba.tests.net_join_no_spnego when run in environment
doesn't support SMB1 so move it to ad_dc_smb1 and remove
skip_smb1_fail entry

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:30 +00:00
Noel Power
6edb46682d s4/selftest: Move samba.tests.auth_log_pass_change to ad_dc_smb1
Test samba.tests.auth_log_pass_change  will fail when run against
environments that don't support SMB1 so move this test to ad_dc_smb1
and remove entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:30 +00:00
Noel Power
fc1121bc6b s4/selftest: Move samba.tests.auth_log to ad_dc_smb1
Test samba.tests.auth_log will fail when run against environments that
don't support SMB1 so move this test to ad_dc_smb1 and removing
entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
a166ddc740 s4/selftest: Move samba4.smb.spnego to ad_dc_smb1
Moving

samba4.smb.spnego.krb5.no_optimistic(ad_dc)
samba4.smb.spnego.ntlmssp.no_optimistic(ad_dc)

and additionally removing the entries from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
ed3b15b33c s4/selftest: Move samba4.rpc.join tests from ad_dc to ad_dc_smb1
Move the following tests from ad_dc to ad_dc_smb1

samba4.rpc.join with bigendian(ad_dc)
samba4.rpc.join with seal,padcheck(ad_dc)
samba4.rpc.join with validate(ad_dc)

and additionally remove the corrosponding entries from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
b056425340 s4/selftest: Move failing samba4.rpc.authcontext.* (ad_dc) to ad_dc_smb1
Move
samba4.rpc.authcontext with bigendian(ad_dc)
samba4.rpc.authcontext with seal,padcheck(ad_dc)
samba4.rpc.authcontext with validate(ad_dc)

to ad_dc_smb1 environment and remove the corrosponding entries in
skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
1c8974b421 s4/selftest: run samba4.libsmbclient.*.NT1.* tests in ad_dc_smb1
additionally remove those related entries from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
0aa44c88d2 s4/selftest: move samba4.dfs.domain to ad_dc_smb1
Additionally remove the test entry from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
422e6c5a79 s4/selftest: adjust samba.blackbox.pdbtest to use (s3) smbclient
smbclient4 only negotiates smb1, this test should use smbclient(s3)
instead.

Signed-off-by: Noel Power <npower@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
7e04d84b5f s4/selftest: Adjust samba4.blackbox.samba_tool to use (s3) smbclient
(s4) smbclient doesn't negotiate smb2, (s3) smbclient is what
is used and what we really should be testing.

Additionally remove entry from ski_smb1_fails file

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
1c3f954ab4 s4/selftest: Use (s3) smbclient for test samba4.blackbox.kinit
Additionally we remove the entry from skip_smb1_fails as it is
no longer relevant

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
3558332228 s4/selftest: Use s3 smbclient for samba4.blackbox.bogusdomain
Additionally remove the test from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
87d77b3ea9 s4/selftest: Add smbclient (s3 version) binary to s4/tests
smbclient4 only negotiates smb1, tests probably should use smbclient
instead (except for tests that intentionally are testing smbclient4
itself)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Stefan Metzmacher
c4ccdf4b30 s4:selftest: run samba.tests.krb5.simple_tests against ad_dc_default
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Mar 27 19:54:25 UTC 2020 on sn-devel-184
2020-03-27 19:54:25 +00:00
Stefan Metzmacher
7010a1311d s4:selftest: run samba.tests.krb5.kcrypto test
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
05d3a909d5 selftest: use 10.53.57.0/8 instead of 127.0.0.1/8
This makes our testing much more realistic and allows
the removal of some knowfail entries.

It also means the testing with network namespaces on Linux
can use the same addresses as our socket wrapper testing.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:38 +00:00
Samuel Cabrero
d809da3ace selftest: Run python.samba.tests.dcerpc.raw_protocol against S3 ad_member
The goal is to pass the raw protocol testsuite against s3 RPC server.
To do so we need to enable epmd and lsasd daemons, as the testsuite
connects to the endpoint mapper and lsa endpoints using NCACN_IP_TCP
and NCACN_NP transports.

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-20 15:36:31 +00:00
Andreas Schneider
ff70d7cc3a tests: Add test for weak crypto
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-19 20:46:42 +00:00
Volker Lendecke
9653a10738 libsmbclient: Put it back to a known, well-working state
For adapting unix extensions in our client libraries, we need a fresh start
with additional APIs. We can't change existing application behaviour.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-03-10 21:25:33 +00:00
Volker Lendecke
a7bdb2936f selftest: Inform smbtorture about running with unix extensions
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-03-03 17:48:38 +00:00
Volker Lendecke
dfa01af749 selftest: run libsmbclient unix ext tests against "posix_share"
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-03-03 17:48:38 +00:00
Volker Lendecke
cb37caaa56 selftest: Run libsmbclient with and without unix extensions
The libsmbclient readdir tests are broken just for the unix extension
case. For example they assume our "map archive" behaviour. This will
have to be parameterized once unix extensions become better
implemented in libsmbclient

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Feb 27 19:34:36 UTC 2020 on sn-devel-184
2020-02-27 19:34:36 +00:00
Volker Lendecke
bb5cf67476 selftest: Introduce planlibsmbclienttest()
Small refactoring

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-27 18:07:29 +00:00
Gary Lockyer
ba518a1deb librpc ndr: add recursion check macros
Add macros to check the recursion depth.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19280
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Volker Lendecke
5076e28aec selftest: Slightly simplify setting up libsmbclient tests
We'll add per-test arguments soon

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Feb 25 19:30:27 UTC 2020 on sn-devel-184
2020-02-25 19:30:27 +00:00
Volker Lendecke
9df3ed7e12 selftest: We don't need an AD DC for libsmbclient tests
In case we would start to actually test kerberos auth via the libsmbclient API
(which we right now don't), this will change again. Until then,

make test TESTS=libsmbclient

is a lot faster this way.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Gary Lockyer
ae6927e4f0 librpc ndr: Heap-buffer-overflow in lzxpress_decompress
Reproducer for oss-fuzz Issue 20083

Project: samba
Fuzzing Engine: libFuzzer
Fuzz Target: fuzz_ndr_drsuapi_TYPE_OUT
Job Type: libfuzzer_asan_samba
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 1
Crash Address: 0x6040000002fd
Crash State:
  lzxpress_decompress
    ndr_pull_compression_xpress_chunk
      ndr_pull_compression_start

Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-07 08:53:40 +00:00
Andrew Bartlett
7b19e221ae CVE-2019-14902 selftest: Add test for replication of inherited security descriptors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Gary Lockyer
f0cebbe4dd test upgradedns: ensure lmdb lock files linked
Add tests to check that the '-lock' files for the dns partitions as well as
the data files are linked when running
    samba_dnsupgrade --dns-backend=BIND9_DLZ
failure to create these links can cause corruption of the corresponding
data file.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14199

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-20 07:35:41 +00:00
Ralph Boehme
ac115db1fc selftest: run samba.tests.samba_tool.user against ad_dc_ntvfs:local explicitly
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-20 06:08:40 +00:00
Ralph Boehme
f3f22851ff selftest: run samba.ldap.referrals against ad_dc_ntvfs explicitly
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-20 06:08:40 +00:00
Ralph Boehme
0f5b66230d selftest: run samba4.ldap.dirsync.python against ad_dc_ntvfs explicitly
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-20 06:08:40 +00:00
Ralph Boehme
88a381389c selftest: run samba.tests.dcerpc.srvsvc against ad_dc_ntvfs explicitly
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-20 06:08:40 +00:00
Ralph Boehme
7974e55024 selftest: run rpc.srvsvc and rpc.mgmt against ad_dc_ntvfs explicitly
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-20 06:08:40 +00:00