1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

2326 Commits

Author SHA1 Message Date
Rowland Penny
84c130a655 samba-tool group show: only shows global security groups, this patch makes it show all groups.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14335

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Björn Baumbach <bb@samba.org>

Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Thu Apr  2 15:27:53 UTC 2020 on sn-devel-184
2020-04-02 15:27:53 +00:00
Stefan Metzmacher
4f6d26609a python/tests/krb5: add simple_tests.py with the first simple test
This just demonstrates that the infrastructure works:-)

I'm running this as:

  SERVER=172.31.9.188 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE \
  USERNAME=administrator PASSWORD=A1b2C3d4 SERVICE_USERNAME="w2012r2-188" \
  python/samba/tests/krb5/simple_tests.py

Pair-Programmed-With: Isaac Boukris <iboukris@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
fb7cba50ae python/tests/krb5: add raw_testcase.py as the base for our Kerberos protocol testing
Pair-Programmed-With: Isaac Boukris <iboukris@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
94d068427f python/tests/krb5: modify rfc4120.asn1 in order to generate pyasn1 code
The pyasn1 bindings are generated by pyasn1gen.py from
https://github.com/kimgr/asn1ate.git

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
a2f75c314e python/tests/krb5: add rfc4120.asn1
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
47385248c8 python/tests/krb5: add support for Cksumtype.MD5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
8bdd379976 python/tests/krb5: convert kcrypto.py to python3-cryptography and a few Samba helpers
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Isaac Boukris
679bb52c95 python/tests/krb5: add crypto.py from greghudson/pyk5 as kcrypto.py
This is crypto.py of commit f0612aa908062fb239d1c3873595e7204ae1691d
from https://github.com/greghudson/pyk5.git

This will be used in order to do raw protocol testing against
[MS-KILE] KDCs.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
0f805db40a python/tests: let usage.py be more verbose on errors
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:34 +00:00
Stefan Metzmacher
05d3a909d5 selftest: use 10.53.57.0/8 instead of 127.0.0.1/8
This makes our testing much more realistic and allows
the removal of some knowfail entries.

It also means the testing with network namespaces on Linux
can use the same addresses as our socket wrapper testing.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:38 +00:00
Stefan Metzmacher
72bbd170fc python/netcmd/dns: improve exception handling in cmd_add_record()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:37 +00:00
Stefan Metzmacher
23bd1eff75 python/netcmd/dns: improve exception handling in cmd_delete_record()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:37 +00:00
Andrew Bartlett
a7633deb89 py3: Remove #define IsPy3BytesOrString(pystr)
This was

  (PyUnicode_Check(pystr) || PyBytes_Check(pystr))

This allows us to end the use of Python 2/3 compatability macros.

The one caller will be simplified in the next commit

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <nopower@samba.org>
2020-03-23 19:12:43 +00:00
Andrew Bartlett
675ab9d6ae py3: Remove #define IsPy3Bytes PyBytes_Check
This allows us to end the use of Python 2/3 compatability macros.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-03-23 19:12:43 +00:00
Andrew Bartlett
5c1867ba45 py3: Remove #define PyInt_FromLong PyLong_FromLong
This allows us to end the use of Python 2/3 compatability macros.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power
2020-03-23 19:12:43 +00:00
Andrew Bartlett
4764e8b4c7 py3: Remove #define PyInt_AsLong PyLong_AsLong
This allows us to end the use of Python 2/3 compatability macros.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-03-23 19:12:43 +00:00
Andrew Bartlett
cc79726d95 py3: Remove #define PyInt_Type PyLong_Type
This allows us to end the use of Python 2/3 compatability macros.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-03-23 19:12:43 +00:00
Andrew Bartlett
3aea3b1538 py3: Remove #define PyInt_Check PyLong_Check
This will allow us to remove some unused code in the PIDL-generated
python bindings.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-03-23 19:12:43 +00:00
Noel Power
5406205382 python/samba/gp_parse: Fix test errors with python3.8
UNEXPECTED(failure): samba.tests.samba_tool.gpo.samba.tests.samba_tool.gpo.GpoCmdTestCase.test_backup_restore_generalize(ad_dc:local)
REASON: Exception: Exception: Traceback (most recent call last):
  File "/tmp/samba-testbase/b28/samba-ad-dc-1/bin/python/samba/tests/samba_tool/gpo.py", line 434, in test_backup_restore_generalize
    self.assertIsNone(has_difference(os.path.join(new_path, 'policy',

This caused because prior to 3.8 minodom.toprettyxml() was sorting the
attribute order, now it preserves the attribute order specified by the user
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-19 20:46:42 +00:00
Gary Lockyer
56e466b4b8 ndrdump tests: Make the tests less fragile
Remove the C source file and line number from the expected output to
make the tests less likely to break if ndr.c changes.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-07 05:09:34 +00:00
Jonathon Reinhart
0dd2a27347 python: Fix userPrincipalName in GetPasswordCommand.get_account_attributes()
Signed-off-by: Jonathon Reinhart <Jonathon.Reinhart@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Mar  5 16:27:50 UTC 2020 on sn-devel-184
2020-03-05 16:27:50 +00:00
Björn Baumbach
534809a0f0 selftest: test samba-tool group commands with groupnames with brackets and spaces
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
f3e7ea0405 samba-tool group edit: use binary encoded group name
Allows to edit groups with names like e.g. 'group1 (xy)'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
104582b73c samba-tool group delete: use binary encoded group name
Allows to delete groups with names like e.g. 'group1 (xy)'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
626209beab samba-tool group move: use binary encoded group name
Allows to move groups with names like e.g. 'group1 (xy)'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
d0f8e83365 samba-tool group listmembers: use binary encoded group names
Allows to find groups with names like e.g. 'group1 (xy)'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
1d2e9f27fa samba-tool group listmembers: find group members by groups SID
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
40e498e743 samba-tool group listmembers: handle group-does-not-exist error
Return a error with a proper message instead of just do nothing when
the target group does not exist.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14296

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Björn Baumbach
789d84c0a9 samba-tool group listmembers: hide python backtracke on command error
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-28 03:08:45 +00:00
Gary Lockyer
23d285d349 librpc ndr: Stack-overflow in ndr_pull_drsuapi_DsaAddressListItem_V1
Reproducer for oss-fuzz Issue 19280

Project: samba
Fuzzing Engine: libFuzzer
Fuzz Target: fuzz_ndr_drsuapi_TYPE_OUT
Job Type: libfuzzer_asan_samba
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffcb4cc2ff8
Crash State:
  ndr_pull_drsuapi_DsaAddressListItem_V1

Sanitizer: address (ASAN)

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19280
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Gary Lockyer
ad78496664 samba-tool domain join: remove sub domain join code
Remove the unused sub domain join code, the option was removed by commit
5583208aed. This commit completely removes
the now unused code.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Feb 11 17:41:32 UTC 2020 on sn-devel-184
2020-02-11 17:41:32 +00:00
Douglas Bagnall
beb829d0e6 samba-tool gpo: tighter matching for ini names
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Fri Feb  7 12:03:34 UTC 2020 on sn-devel-184
2020-02-07 12:03:34 +00:00
Douglas Bagnall
07fa6678e4 python: use raw string for regex with escape
Python regards 'GPT\.INI$' as a string containing an invalid escape
sequence '\.', which is ignored (i.e. treated as the literal sequence
of those 2 characters), but only after Python has grumbled to itself,
and to you if you enabled DeprecationWarnings.

The proper thing to do here is use r-strings, like r'GPT\.INI$', which
tell Python that all backslashes are literal. Alternatively (as we do
once in this patch), the backslash can itself be escaped ('\\').

There are more problems of this nature in the build scripts.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-02-07 10:37:37 +00:00
Douglas Bagnall
c247afbda0 pytests: heed assertEquals deprecation warning en-masse
TestCase.assertEquals() is an alias for TestCase.assertEqual() and
has been deprecated since Python 2.7.

When we run our tests with in python developer mode (`PYTHONDEVMODE=1
make test`) we get 580 DeprecationWarnings about this.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2020-02-07 10:37:37 +00:00
Gary Lockyer
ae6927e4f0 librpc ndr: Heap-buffer-overflow in lzxpress_decompress
Reproducer for oss-fuzz Issue 20083

Project: samba
Fuzzing Engine: libFuzzer
Fuzz Target: fuzz_ndr_drsuapi_TYPE_OUT
Job Type: libfuzzer_asan_samba
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 1
Crash Address: 0x6040000002fd
Crash State:
  lzxpress_decompress
    ndr_pull_compression_xpress_chunk
      ndr_pull_compression_start

Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-07 08:53:40 +00:00
Andrew Bartlett
c8e3c78d4f selftest: Test behaviour of DNS scavenge with an existing dNSTombstoned value
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14258

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Feb  6 16:24:25 UTC 2020 on sn-devel-184
2020-02-06 16:24:25 +00:00
Stefan Metzmacher
590df382be s3:auth_sam: map an empty domain or '.' to the local SAM name
When a domain member gets an empty domain name or '.', it should
not forward the authentication to domain controllers of
the primary domain.

But we need to keep passing UPN account names with
an empty domain to the DCs as a domain member.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-05 16:30:42 +00:00
Björn Baumbach
cf9850b4e0 samba-tool group addmembers: avoid python traceback on member add failure
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:47 +00:00
Björn Baumbach
557fa1d44b samba-tool group addmembers: add --member-base-dn option for group member search
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:47 +00:00
Björn Baumbach
5b129bf12b samba-tool group {add,remove}members: allow to use --member-dn in combination with listofmembers
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:47 +00:00
Björn Baumbach
47f9ee91ed samba-tool group removemembers: adapt functionality to addmembers command
Adds --member-dn and --object-types options.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
aedcf6a527 samba-tool group addmembers: add --member-dn option
The --member-dn option allows to specify an object by it's DN.

This is required to select a specific object if there are more than one
with the same name. Multiple contacts can exist with the same name in
different OUs.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
f2e2579926 samba-tool group addmembers: add new option --object-types
With this option the admin can specify the object types of the group
members which will be added to the group. The search filter for the objects
will be created according to the types.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
a4d77bfd90 python/samdb: validation of group member types for group member filter
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
f9bf6b7856 python/samdb: add type "all" to search for all common types of group members
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
c4e899d6b4 python/samdb: adapt search filter for group object type
Use a group search filter which is similar to the filter which is used
by the basic MS Windows group membership management.

The filter excludes the group type GROUP_TYPE_BUILTIN_LOCAL_GROUP.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
45abb4fd4f python/samdb: adapt search filter for user object type
Use a user search filter which is similar to the filter which is used
by the basic MS Windows group membership management.

The filter filters for objects with the sAMAccountType ATYPE_NORMAL_ACCOUNT.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
2baa301237 python/samdb: add 'computer' to the default group member types for group member filters
Add the 'computer' type to the default member types, so that the next
commit does not change the default behavior.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
2abebee140 python/samdb: fetch specific error if there are more than one search results
There can be more than one contact with the same name.

Signed-off-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00
Björn Baumbach
e3099ac407 python/samdb: add more object types for adding/remove group members
The filters are based on the MS Windows filter, which are used by the
basic group member management dialog.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:46 +00:00