1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

137347 Commits

Author SHA1 Message Date
Rob van der Linde
cf60e3cad6 netcmd: gmsa: improve descriptions of --dns-host-name and match docs
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
828420b4f0 python: domain: models: add OrganizationalUnit container model
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
5ac4b6969b python: domain: models: move OrganizationalPerson to org.py
There are other models like OrganizationalUnit which can go in org.py better if this is done first

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
3c0833ead5 python: domain: models: move MODELS to registry.py because it's not really a constant
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
bfd1f8cd46 python: domain: models: MODELS lookup does need to include base Model for shell command
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
0c5d09ae14 python: domain: models: add children method to return a models direct children
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
cca0cfe421 python: tests: write a test for the Model.as_dict method
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
917e2a7353 python: tests: computer model tests should clean up
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Rob van der Linde
ed07dee864 python: domain: models: as_dict() should also exclude empty list fields
Empty list fields happen if many=True is used on the field. This means that the field is automatically initialised as an empty list, so this can only ever be sa list or None.

The side-effect of this was that it appears in as_dict() when it shouldn't, because the field isn't populated. This fixes it.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
fc982e550f s4-dsdb: Create KdfParameters at runtime
While this is by definition less efficient, I prefer not to have the magic
buffer of pre-caclulated bytes, we don't create Root Keys very often.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
d316e5f086 s4-dsdb: Indent DH parameters table in gkdi_create_root_key()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
3687bf22aa s4-dsdb: Populate new GKDI root keys from the server configuration object
This honours MS-GKDI 3.1.4.1.1 Creating a New Root Key

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
565314f448 pyldb: Improve search for error string in PyErr_SetLdbError
We allow a fallback to ldb_strerror() even if there was an LDB context,
allowing failing functions to reset a previous error string but not
set a new one.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
06912de3b2 dsdb: Add API tests for new_gkdi_root_key()
These show that the new root key should be based on the server
configuration object, not just hardcoded defaults.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
f379ea8b81 pyldb: Consolidate PyErr_SetLdbError() using the pyldb version
Now that pyldb-util is a private library to Samba, we have no excuses not to
consolidate helper functions like this.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
287cf82682 plydb: Keep talloc_reference() to the DN in PyDict_AsMessage
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:41 +00:00
Andrew Bartlett
37327afd0a pyldb: Fix documentation comment on Message.from_dict() method
This method does not take keyword arguments.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-28 01:50:40 +00:00
Anoop C S
f0a8d83268 s4/torture: Fix misplaced positional arguments for u64 comparison
torture_assert_u64_equal_goto() can only print meaningful error message
for incorrect values if only if the function is invoked with test run
value and expected value respectively as second and thrid arguments.
Otherwise it displays the reversed message causing confusion in overall
test results.

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Mar 27 13:00:29 UTC 2024 on atb-devel-224
2024-03-27 13:00:29 +00:00
Björn Jacke
0dec2ef188 Revert "token_util.c: prefer capabilities over become_root"
This reverts commit 944cb51506.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Mar 27 10:47:23 UTC 2024 on atb-devel-224
2024-03-27 10:47:23 +00:00
Björn Jacke
32aa11e9b5 Revert "dosmode.c: prefer use of capabilities at two places over become_root"
This reverts commit c1e2fbb1b9.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
33e88911ee Revert "nfs4_acls.c: prefer capabilities over become_root"
This reverts commit 06e5c1e32e.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
af7b930e2b Revert "vfs_acl_common.c: prefer capabilities over become_root"
This reverts commit 12734848dc.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
52ad635b27 Revert "vfs_default.c: prefer capabilities over become_root"
This reverts commit 62464bd2db.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
10c7a3e47c Revert "vfs_posix_eadb.c: prefer capabilities over become_root"
This reverts commit 92278418dc.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
7f19afbd40 Revert "vfs_recycle.c: prefer capabilities over become_root"
This reverts commit 4227b011f6.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
88eb58af67 Revert "open.c: prefer capabilities over become_root"
This reverts commit b250f25fe4.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
8747954438 Revert "posix_acls.c: prefer capabilities over become_root"
This reverts commit 1edf9ecaf5.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
Björn Jacke
58ea952fd0 Revert "dosmode: prefer capabilities over become_root"
This reverts commit 5e925f9755.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2024-03-27 09:40:34 +00:00
David Mulder
9550d37f2f winbind: Log NOT_IMPLEMENTED as debug
This message happens frequently when running a
PDC/NT4 mode w/out winbind.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Mar 27 02:15:31 UTC 2024 on atb-devel-224
2024-03-27 02:15:31 +00:00
Noel Power
03240c91fb libcli/http: Handle http chunked transfer encoding
Also removes the knownfail for the chunked transfer test

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611
2024-03-27 01:14:31 +00:00
Noel Power
30acd609f5 tests: add test for chunked encoding with http cli library
Adds http test client to excercise the http client library
and a blackbox test to run the client. This client is built
only with selftest

also adds a knownfail for the test

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611
2024-03-27 01:14:31 +00:00
Noel Power
5f03d84e3b libcli/http: Optimise reading for content-length
Instead of reading byte-by-byte we know the content length we
want to read so lets use it.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611
2024-03-27 01:14:31 +00:00
Noel Power
74cdebeae3 selftest: Add basic content-lenght http tests
very simple test of basic http request/response plus some checks to
ensure http response doesn't exceed the response max length set by
the client call.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-27 01:14:31 +00:00
Noel Power
cd6c075476 Add simple http_client for use in black box tests (in following commits)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15611
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-27 01:14:31 +00:00
Douglas Bagnall
6fb98f70c6 ndr: always attempt ACE coda pull if ACE type suggests a coda
We were skipping the pull in cases where the coda size was calculated
to be zero. This has the right result for empty conditional ACEs, but
not for Resource Attribute ACEs where the
CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 coda was not intialised.

The situation is made a bit worse, because the function that
calculates the coda size (ndr_subcontext_size_of_ace_coda()) can
return zero in conditions that are not exactly errors, but in which
the would-be calculated value makes so little sense that zero is
thought to be a safer default.

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66577
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15613

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Mar 25 06:00:21 UTC 2024 on atb-devel-224
2024-03-25 06:00:21 +00:00
Volker Lendecke
7edf5467fc lib: Remove timeval_set()
We have the same function in tevent, no need to duplicate code. More lines just
due to clang-format.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar 22 06:07:42 UTC 2024 on atb-devel-224
2024-03-22 06:07:42 +00:00
Volker Lendecke
a3e186b617 lib: Remove timeval_until()
We have the same function in tevent, no need to duplicate code.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22 05:03:35 +00:00
Douglas Bagnall
842e737843 fuzz:fuzz_ndr_X: don't skip printing on push error
push should not have changed the struct, so it is valid to
try to print it also.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22 05:03:35 +00:00
Douglas Bagnall
cebe12bc85 ldb-samba: matching rules: notify of search failure in transitive filter
It can be very hard to known where transitive checks fail, and this
will help.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15515

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22 05:03:35 +00:00
Douglas Bagnall
90964caaf2 fuzz:_conditional_ace_blob discards a const
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22 05:03:35 +00:00
Douglas Bagnall
e1071cd1df fuzz:fuzz_conditional_ace_blob lets long generated SDDL fail
This can legitimately fail, due to e.g. integers being interpreted as
local attributes due to their position (the original data is complete
nonsense, bravely decompiled by sddl_from_conditional_ace).

In the example found the original begins like

00000000  61 72 74 78 02 00 00 00  00 00 00 00 00 03 01 02 |artx............|
00000010  f7 ff ff ff ff ff ff ff  03 01 a1 02 00 3b 00 00 |.............;..|
00000020  00 00 00 00 03 01 a1 02  00 3b 00 00 00 00 00 00 |.........;......|
00000030  03 01 02 a5 ff ff ff ff  ff ff ff 03 01 a1 02 78 |...............x|
00000040  00 00 00 00 00 00 00 03  01 85 02 00 3b 00 00 00 |............;...|
00000050  00 00 00 03 01 a1 02 00  3b 00 00 00 00 00 00 03 |........;.......|
00000060  01 02 a5 00 00 00 00 00  00 00 03 01 81 02 00 00 |................|
00000070  00 00 00 00 00 00 03 01  81 02 00 3b 00 00 00 00 |...........;....|

while the SDDL cycled version looks like

00000000  61 72 74 78 f8 04 00 00  00 30 00 30 00 f8 2e 00 |artx.....0.0....|
00000010  00 00 30 00 31 00 37 00  37 00 37 00 37 00 37 00 |..0.1.7.7.7.7.7.|
00000020  37 00 37 00 37 00 37 00  37 00 37 00 37 00 37 00 |7.7.7.7.7.7.7.7.|
00000030  37 00 37 00 37 00 37 00  37 00 37 00 36 00 37 00 |7.7.7.7.7.7.6.7.|
00000040  a1 f8 0c 00 00 00 30 00  33 00 35 00 34 00 30 00 |......0.3.5.4.0.|
00000050  30 00 a1 f8 0c 00 00 00  30 00 33 00 35 00 34 00 |0.......0.3.5.4.|
00000060  30 00 30 00 f8 2e 00 00  00 30 00 31 00 37 00 37 |0.0......0.1.7.7|
00000070  00 37 00 37 00 37 00 37  00 37 00 37 00 37 00 37 |.7.7.7.7.7.7.7.7|

and this new interpretation ends up being more than 10000 bytes long,
so the conversion fails.

The SDDL ends up looking like this:

  (((((((((((00) || (01777777777777777777767)) || (035400)) || \
  (((((((((((((((((((((((((((((((((((035400) || (01777777777777777777645)) \
  >= 0170) || (035400)) || (((((((((((((((((((((((((((((((035400 != 0245)
  [...]

where all the octal digits on the left hand side of operators are
UTF-16 strings.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65322

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22 05:03:35 +00:00
Douglas Bagnall
168e5df62f fuzzing: fuzz_ndr_X ndr_print does printing
By printing into a buffer, we might notice some errors.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22 05:03:35 +00:00
Jo Sutton
4f0ed9b003 tests/krb5: Add tests for AllowedToAuthenticateTo with an AS-REQ
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15607

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Mar 21 04:19:18 UTC 2024 on atb-devel-224
2024-03-21 04:19:18 +00:00
Jo Sutton
eac2395415 s4:auth: Update error messages
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00
Jo Sutton
67af86d2ab auth:credentials: Remove unused include
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00
Jo Sutton
8b86174bd3 auth:credentials: Remove trailing line
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00
Jo Sutton
67457394e4 tests/krb5: Allow specifying SamDB to use when creating an account
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00
Jo Sutton
0bc8d1469b python:tests: Do not have current_time() and current_nt_time() implicitly include clock skew
This is just too error‐prone.

current_gkid() will still continue to return the next GKID if it’s
within clock skew.

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00
Jo Sutton
96ac8144b4 python: Correct time conversion function name
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00
Jo Sutton
cd44f8063b s4:libnet: Fix code spelling
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21 03:12:33 +00:00