1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

760 Commits

Author SHA1 Message Date
Andrew Bartlett
2a49c74519 python-libnet: Use new NTSTATUSError, WERRORError and DsExtendedError exceptions
This will allow callers to catch specific errors rather than RuntimeException

As this slightly changes the exception, the timecmd test must be updated.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12398
2016-11-04 04:41:19 +01:00
Andrew Bartlett
e51256c7d5 python: Add DsExtendedError Exception
This will be used for checking errors during a GetNCChanges EXOP like
RID Set allocation.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12398
2016-11-04 04:41:19 +01:00
Andrew Bartlett
c8505c53da python: create NTSTATUSError, HRESULTError and WERRORError
The advantage of these over the previous use of just RuntimeError is that we can
catch just the errors we want, without having to catch all possible RuntimeError
cases and assume they decode to a tuple

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12398
2016-11-04 04:41:19 +01:00
Andrew Bartlett
09537a67b0 dbcheck: Correctly initialise keep_transaction in missing_parent test
Otherwise there is no point to this variable, we are trying to work out
if the subsequent modify succeded

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9954
2016-11-04 04:41:19 +01:00
Clive Ferreira
7fd5be535a dbcheck: confirm RID Set presence and consistency
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9954
2016-11-04 04:41:19 +01:00
Andrew Bartlett
035df7adbe dsdb: Add python hooks to allocate a RID set and allocate a RID pool
This will help us to correct errors during dbcheck

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9954
2016-11-04 04:41:18 +01:00
Amitay Isaacs
2959c8888d provision: Add support for BIND 9.11.x
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12366

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Oct 28 03:42:25 CEST 2016 on sn-devel-144
2016-10-28 03:42:25 +02:00
Stefan Metzmacher
9ef8bfabc6 python/tests: add simple dcerpc orphaned tests
ORPHANED is mostly ignored. It's up to the application server
implementation to install a orphaned handler.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
3c474cd489 python/tests: add simple dcerpc co_cancel tests
CO_CANCEL is mostly ignored. It's up to the application server
implementation to install a cancel handler.

The only implementation I found so far is the witness server
(see [MS-SWN] WitnessrAsyncNotify), which triggers a FAULT
with DCERPC_FAULT_SERVER_UNAVAILABLE.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
04c934319f python/tests: add simple dcerpc association group tests
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
ca88aa8124 python/tests: add a second_connection() helper function
This can be used to create a 2nd connection.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
4a82e83bf9 python/tests: check context_id values of responses correctly
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
63c2cbf0a0 python/tests: make use of self.get_auth_context_creds() and self.do_generic_bind() in _test_spnego_bind_auth_level()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
9d647bdaf3 python/tests: make use of self.get_anon_creds() and self.get_user_creds()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:20 +02:00
Stefan Metzmacher
3eae2a3427 python/tests: make use of get_auth_context_creds() in _test_auth_type_level_bind_nak()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
b779f07031 python/tests: make use of prepare_presentation() in _get_netlogon_ctx()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
b6569bd122 python/tests: make it possible to specific TARGET_HOSTNAME to raw_protocol.py
SMB_CONF_PATH=/dev/null \
  SERVER=w2012r2-188.w2012r2-l6.base \
  USERNAME=administrator PASSWORD=A1b2C3d4 \
  python/samba/tests/dcerpc/raw_protocol.py -v -f TestDCERPC_BIND

or

SMB_CONF_PATH=/dev/null \
  SERVER=172.31.9.188 TARGET_HOSTNAME=w2012r2-188.w2012r2-l6.base \
  USERNAME=administrator PASSWORD=A1b2C3d4 \
  python/samba/tests/dcerpc/raw_protocol.py -v -f TestDCERPC_BIND

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
d5b58bb730 python:tests: add more helper functions to RawDCERPCTest
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
b788507cff python/tests: we now pass test_no_auth_request_bind_pfc_CONC_MPX()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
36385711f7 python:ndr: add ndr_{pack,unpack,print}_{in,out} helper functions
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
9b842badcb python:ndr: verify the object type ndr_print() and ndr_unpack()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:19 +02:00
Stefan Metzmacher
be8d4900e9 python/tests: add DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN tests to dcerpc raw protocol tests
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:17 +02:00
Stefan Metzmacher
5f17d3bd29 python/tests: do tests to verify spnego various auth_levels
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:15 +02:00
Stefan Metzmacher
60099d491b python/tests: add bind time feature related tests to dcerpc raw protocol tests
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:14 +02:00
Stefan Metzmacher
6d70989c5c python/tests: add presentation context related tests to dcerpc raw protocol tests
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:14 +02:00
Stefan Metzmacher
00363cd267 python/tests: remove unused code in _test_auth_none_level_bind()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:14 +02:00
Stefan Metzmacher
4464896167 dcerpc.idl: split the padding from a possible fault buffer in dcerpc_fault
The 4 bytes of padding are always present and part of the header.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-10-26 11:20:12 +02:00
Marc Muehlfeld
34d98a80a8 Replaced string "Samba 4" with "Samba AD"
When provisioning a new DC, a message is displayed that a Kerberos
configuration file has been created. The message now uses the term
"Samba AD" instead of "Samba 4".

Signed-off-by: Marc Muehlfeld <mmuehlfeld@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Oct 10 22:34:03 CEST 2016 on sn-devel-144
2016-10-10 22:34:03 +02:00
Rowland Penny
780a80c28d bug 12293: stop group.py throwing errors if group is unknown
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12293

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Fri Sep 30 05:53:17 CEST 2016 on sn-devel-144
2016-09-30 05:53:16 +02:00
Rowland Penny
22da0887b2 bug 12292: stop user.py throwing errors if user is unknown
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12292

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-09-30 02:11:21 +02:00
Garming Sam
60e4bd381a kcc: Don't check schedule if None
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12286

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Fri Sep 23 06:52:28 CEST 2016 on sn-devel-144
2016-09-23 06:52:28 +02:00
Christian Ambach
92178f02bd python/join: do not attempt to parse log level, use parsed value
The log level parameter can contain debug class specific entries.
Do not attempt to parse this as int, but use the values that the
debugging system already parsed

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9945
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-14 19:31:21 +02:00
Christian Ambach
dd25aa129b python/drs_utils: do not attempt to parse log level, use parsed value
The log level parameter can contain debug class specific entries.
Do not attempt to parse this as int, but use the values that the
debugging system already parsed

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9945
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-14 19:31:21 +02:00
Christian Ambach
fa56dbf670 tests/param add a test for LoadParm.log_level
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-14 19:31:20 +02:00
Garming Sam
451907739c tests/dns_forwarder: Fail out with an assertion instead OOB error
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Sep  6 15:41:54 CEST 2016 on sn-devel-144
2016-09-06 15:41:54 +02:00
Garming Sam
ad3b3e978e tests/dns_forwarder: Check that the subprocess is still living
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-06 11:50:09 +02:00
Garming Sam
668e4e4a43 tests/dns_forwarder: Wait for port for 15 seconds
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-06 11:50:09 +02:00
Andrew Bartlett
aef1d45c9a samba-tool: Remove --use-xattrs support without --use-ntvfs
The only reasonable use --use-xattrs=no should be used is in selftest,
and there is no need for that or --use-xattrs=auto without
--use-ntvfs, all systems we support in production for the AD DC have
xattrs, as using smbd needs posix ACLs.

This also removes the option entirely if NTVFS support is omitted from
the build.

I would prefer to get rid of the option, but currently selftest relies
on the default of --use-xattrs=auto, and we first should get rid of
that auto-detection, which will then mean we need --use-xattrs=no
specified wherever we specify --use-ntvfs.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Sep  6 04:21:42 CEST 2016 on sn-devel-144
2016-09-06 04:21:42 +02:00
Andrew Bartlett
5620616968 samba-tool: Run samba-tool domain tombstones expunge in a transaction
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-09-01 05:49:15 +02:00
Andrew Bartlett
55b9b9a969 samba-tool: Add command-line tool to trigger tombstone expunge
This allows us to carefully test the garbage collection of tombstoned objects
without running the full server and waiting for the timer to expire

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-09-01 05:49:15 +02:00
Andrew Bartlett
02d82af06f python: Add binding for dsdb_garbage_collect_tombstones()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-09-01 05:49:15 +02:00
Rowland Penny
dd5439e8c8 tests/samba-tool/user.py: replace deprecated 'add' subcommand with 'create'
Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Aug 30 09:21:09 CEST 2016 on sn-devel-144
2016-08-30 09:21:09 +02:00
Andrew Bartlett
db32a0e5ea dbcheck: Abandon dbcheck if we get an error during a transaction
Otherwise, anything that the transaction has already done to the DB will be left in the DB
even despite the failure.  For example, if a fix wrote to the DB, but then failed a post-write
check, then the fix will not be unrolled.

This is because we do not have nested transactions in TDB.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12178

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Aug 29 12:46:21 CEST 2016 on sn-devel-144
2016-08-29 12:46:21 +02:00
Douglas Bagnall
3c103f9b1a netcmd/domain: improve error message grammar
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Fri Aug 19 17:30:39 CEST 2016 on sn-devel-144
2016-08-19 17:30:39 +02:00
Douglas Bagnall
e7ad8727be KCC: Fix misnamed variable in DSA object
Found by Garming. Unlikely to affect anyone.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12143

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Fri Aug 12 08:20:31 CEST 2016 on sn-devel-144
2016-08-12 08:20:31 +02:00
Stefan Metzmacher
a0e60e96aa samba-tool/ldapcmp: ignore differences of whenChanged
This is implicitly replicated, but may diverge on updates of non-replicated
attributes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12129

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Aug  8 17:34:24 CEST 2016 on sn-devel-144
2016-08-08 17:34:24 +02:00
Stefan Metzmacher
dcdef0082a tests:blackbox: let samba_dnsupdate.py provide more details
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12108

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-08-04 18:26:07 +02:00
Stefan Metzmacher
62b7e73d40 tests:samba_tool: make use of assertCmdFail() in gpo.py
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12108

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-08-04 18:26:06 +02:00
Stefan Metzmacher
fed029a624 tests:samba_tool: pass stdout and stderr to assertCmdSuccess()
This allows us to generate better assert messages and give the
developer some ideas why the command wasn't able to run.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12108

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-08-04 18:26:06 +02:00
Stefan Metzmacher
d28252765b tests:samba_tool_drs: test samba-tool drs replicate with --async-op
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@samba.org>
2016-07-28 10:06:11 +02:00
Stefan Metzmacher
47d9b0ed64 tests:samba_tool_drs: test samba-tool drs replicate with implicit machine credentials
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@samba.org>
2016-07-28 10:06:11 +02:00
Stefan Metzmacher
cba7e94522 samba-tool: add --async-rep option to 'samba-tool drs replicate'
We may not want to wait for the replication to finish.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@samba.org>
2016-07-28 10:06:11 +02:00
Stefan Metzmacher
3cb3fc36dd samba-tool: use a timeout of 5 minutes in 'samba-tool drs replicate'
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@samba.org>
2016-07-28 10:06:10 +02:00
Garming Sam
8dabd57d1c kcc: Clean up repsTo attribute for old DCs
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Jul 26 05:11:57 CEST 2016 on sn-devel-144
2016-07-26 05:11:57 +02:00
Garming Sam
9427a2424a kcc: Add a TODO for msDS[-RO]-Replica-Locations
When you modify the replica locations to exclude a DSA, it should be respected.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-26 01:22:16 +02:00
Garming Sam
f95bbc7933 kcc: Add corresponding methods for repsTo
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-26 01:22:16 +02:00
Garming Sam
5505e36fc1 kcc: fix a typo
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 25 17:42:33 CEST 2016 on sn-devel-144
2016-07-25 17:42:33 +02:00
Garming Sam
1f1edb65bf kcc: typo fix tupple => tuple
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
2016-07-25 13:56:11 +02:00
Stefan Metzmacher
bbe3a6a1b1 python:samba/tests: use 'samba-tool user {getpassword,syncpasswords}' with --decrypt-samba-gpg
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-07-22 16:03:27 +02:00
Stefan Metzmacher
f45a0ffe86 samba-tool: add --decrypt-samba-gpg support to 'user getpasswords' and 'user syncpasswords'
This get's the cleartext passwords by decrypting
the 'Primary:SambaGPG' value in order to provide the
virtual attributes: virtualClearTextUTF16, virtualClearTextUTF8,
virtualCryptSHA256, virtualCryptSHA512, virtualSSHA

The virtual attribute virtualSambaGPG provides the raw
(encrypted) value of the 'Primary:SambaGPG' value.

See the "password hash gpg key ids" option for the encryption part
of this feature.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-07-22 16:03:27 +02:00
Stefan Metzmacher
8791960bf6 python:samba/tests: add simple 'samba-tool user syncpasswords' test
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-07-22 16:03:26 +02:00
Stefan Metzmacher
c68cb6a1d9 samba-tool: add 'user syncpasswords' command
This provides an easy way to keep passwords in sync with
another account database, e.g. an OpenLDAP server.

It provides a functionality like the "passwd program"
for the "unix password sync" feature of a standalone, member
and classic (NT4) server, but for an active directory domain
controller.

The provided script is called for each account/password related
change.

Like the 'user getpassword' command it allows virtual attributes like:
virtualClearTextUTF16, virtualClearTextUTF8,
virtualCryptSHA256, virtualCryptSHA512, virtualSSHA

Note that this command should just run on a single domain controller
(typically the PDC-emulator).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-07-22 16:03:26 +02:00
Stefan Metzmacher
4ef52663c1 python:samba/tests: verify the packages order in supplementalCredentials
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-22 16:03:26 +02:00
Stefan Metzmacher
3add197e20 python:samba/tests: add simple 'samba-tool user getpassword' test
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-22 16:03:26 +02:00
Stefan Metzmacher
deb2a0258e samba-tool: add 'user getpassword' command
This provides an easy way to get the passwords of a user
including the cleartext passwords (if stored) and derived
hashes. This is done by providing virtual attributes like:
virtualClearTextUTF16, virtualClearTextUTF8,
virtualCryptSHA256, virtualCryptSHA512, virtualSSHA

This is much easier than using ldbsearch and manually parsing
the supplementalCredentials attribute.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-07-22 16:03:26 +02:00
Garming Sam
10f256a7fe kcc: correct a typo in the debug messages
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
3eb7fab04b dbcheck: Add a rule regarding replica locations
This fixes any RW DCs with repsFrom without the corresponding link. On
any RODC, this just reports an error (and doesn't fix it).

(the knownfail entry is also now removed)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
5d470d2886 join.py: Don't add replica locations without the backend
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
15ca517da8 join.py: Add Replica-Locations for DomainDNS and ForestDNS
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
6212836e4e join.py: Ensure that all expressions are escaped
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
0c8e9a862a kcc: Make more fault tolerant on DC demotion
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
a5e0a2fef1 samba_kcc: match translate connection from old KCC for RWDC
This makes it so that repsTo are always regenerated on the target DCs.
This also happens elsewhere in drepl_out, but is to be removed.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
9206a10a8c samba_kcc: match translate connection from old KCC for RODC
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:08 +02:00
Garming Sam
9dfd55c83a kcc: Prevent the KCC from doing work on the RODC
This should never have done any real work, new code or not. This just removes
the initial KCC calls and bails out in the KCC if we actually ran it.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-21 06:37:07 +02:00
Garming Sam
a464a897f3 samba-tool: Speed up all samba-tool commands
This in particular helps the docs.py test halve in time (at least on my machine)

NOTE: The removal of enable_null_tracking is required because we are no
longer importing join.py in every single samba-tool invocation. Without
removing this line, memory would be hanging from both the actual NULL
context and the talloc_null_context (causing a segfault at system_exit).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Wed Jul 20 12:47:24 CEST 2016 on sn-devel-144
2016-07-20 12:47:24 +02:00
Garming Sam
12dce74b80 join.py: Remove talloc enable_null_tracking
The removal of enable_null_tracking is required because we will no
longer importing join.py in every single samba-tool invocation. Without
removing this line, memory would be hanging from both the actual NULL
context and the talloc_null_context (causing a segfault at system_exit).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-19 13:41:12 +02:00
Andrew Bartlett
5568892d43 samba-tool: Put full command and subcommand in informative name when testing samba-tool
These are not used for anything other than to print in the usage, but
it seems nicer to match normal invocation of these commands

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-07-19 13:41:11 +02:00
Garming Sam
52ac6d1f95 dbcheck: Split out valid stale DN links and invalid ones
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-15 10:01:30 +02:00
Garming Sam
5361fc6843 dbcheck: change argument to specify a partial --yes
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-15 10:01:30 +02:00
Douglas Bagnall
0b1405039c dbcheck: check for linked atributes that should not exist
In order to do this we need to use the reveal internals control, which
breaks the comparison against extended DNs. So we compare the
components instead.

Because this patch makes our code notice and fix stale one-way-links
(eg, after a rename) now, the renamedc test needs to be adjusted to
match.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-07-15 10:01:29 +02:00
Douglas Bagnall
ca839cf88a dbcheck: cache linkIDs and reverse attribute names
This avoids fetching the same same schema things again and again.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-15 10:01:29 +02:00
Garming Sam
2df3feaa78 dbcheck: Script swallows input when given a carriage return
Signed-off-by: Garming Sam <garming@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-15 10:01:28 +02:00
Stefan Metzmacher
f8181360a8 python/remove_dc: handle dnsNode objects without dnsRecord attribute
If we have dnsNode objects without dnsRecord attribute values we trigger
the following error triggered by 'samba-tool domain demote --remove-other-dead-server=server2'

  ERROR(<type 'exceptions.TypeError'>): uncaught exception - __ndr_unpack__()
  argument 1 must be string or read-only buffer, not dnsp.DnssrvRpcRecord
    File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 175,
  in _run
      return self.run(*args, **kwargs)
    File "/usr/lib64/python2.6/site-packages/samba/netcmd/domain.py", line 720, in
  run
      remove_dc.remove_dc(samdb, logger, remove_other_dead_server)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 423, in
  remove_dc
      remove_dns_account=True)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 351, in
  offline_remove_ntds_dc
      remove_dns_account=remove_dns_account)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 266, in
  offline_remove_server
      remove_dns_references(samdb, logger, dnsHostName)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 186, in
  remove_dns_references
      for v in values if not to_remove(v) ]
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 160, in
  to_remove
      dnsRecord = ndr_unpack(dnsp.DnssrvRpcRecord, value)
    File "/usr/lib64/python2.6/site-packages/samba/ndr.py", line 45, in ndr_unpack
      object.__ndr_unpack__(data, allow_remaining=allow_remaining)
  A transaction is still active in ldb context [0xe1f320] on
  tdb:///var/lib/samba/private/sam.ldb

"next" is used in perl not in python!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12018

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 13 10:10:30 CEST 2016 on sn-devel-144
2016-07-13 10:10:30 +02:00
Andrew Bartlett
b9b64438d5 samba-tool drs replicate: Allow replication call to take as long as required
This matches the behaviour in the drsuapi server for DsReplicaSync

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-07-12 23:24:13 +02:00
Andrew Bartlett
2d3fdc0a45 pyrpc: Allow control of RPC timeout for IRPC
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-07-12 23:24:13 +02:00
Rowland Penny
792f89cdb6 Fix typo in python/samba/provision/__init__.py
Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jul 12 06:58:47 CEST 2016 on sn-devel-144
2016-07-12 06:58:47 +02:00
Garming Sam
4c4c3e0fcf tests/dns_update: Add error message for diagnosis
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Jul 11 10:58:16 CEST 2016 on sn-devel-144
2016-07-11 10:58:15 +02:00
Andrew Bartlett
6e4e914c76 selftest: Add more tests for samba-tool drs replicate
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul  8 13:39:01 CEST 2016 on sn-devel-144
2016-07-08 13:39:01 +02:00
Andrew Bartlett
eeb0c97fdf samba-tool: Add --local-online mode to samba-tool drs replicate
This mode avoids an issue with using -P on an RODC, instead using an IRPC message
to trigger online replication right away

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-07-08 10:01:20 +02:00
Andrew Bartlett
ae2bd0012c samba-tool: Add success message to samba-tool drs replicate --local
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-07-08 10:01:20 +02:00
Stefan Metzmacher
3f66ccdfd2 tests:samba3sam: make use of the dsdb_flags_ignore module
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-08 10:01:20 +02:00
Bob Campbell
6e378546ce provision: Ignore duplicate attid and governsID check
During the provision this causes a huge performance hit as these two
attributes are unindexed.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
2016-07-06 15:35:17 +02:00
Bob Campbell
c76b0090ae provision_fill: move GPO into transaction
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
2016-07-06 15:35:17 +02:00
Bob Campbell
60375abe46 provision_fill: move most db accesses into transactions
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
2016-07-06 15:35:17 +02:00
Bob Campbell
ef0cbc5560 selftest: add check password script test
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-05 00:00:14 +02:00
Stefan Metzmacher
cc262afe1c samba-tool: add 'samba-tool user setpassword --smartcard-required/--clear-smartcard-required'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30 03:30:24 +02:00
Stefan Metzmacher
04f8ee3ab3 samba-tool: do a password retype validation check for 'samba-tool user setpassword'
This matches the behavior of 'samba-tool user create' and 'samba-tool user password'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30 03:30:24 +02:00
Stefan Metzmacher
7ffffc93f9 samba-tool: add --smartcard-required option to 'samba-tool user create'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30 03:30:24 +02:00
Stefan Metzmacher
9a8186167e samdb.py: add smartcard_required option to newuser()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30 03:30:24 +02:00
Stefan Metzmacher
959384ff18 samba-tool: really deprecate 'samba-tool user add'
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-27 05:00:15 +02:00
Stefan Metzmacher
c49f9abb19 python/tests: add auth_pad test for the dcerpc raw_protocol test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jun 24 18:08:44 CEST 2016 on sn-devel-144
2016-06-24 18:08:44 +02:00
Garming Sam
e2743b110f flapping: temporarily add samba_dnsupdate test
This should be removed when we can run nsupdate on sn-devel

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Jun 16 08:37:56 CEST 2016 on sn-devel-144
2016-06-16 08:37:56 +02:00
Garming
b4d2e1016d drs: Send DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP by default
This flag is not implemented in Samba, however, on an RODC replicating from
Windows, failing to send this flag leaves out group memberships.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-16 04:40:14 +02:00
Andrew Bartlett
c752e93fc5 selftest: Add a DNS test matching Windows
This performs the same steps as Windows does

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:14 +02:00
Andrew Bartlett
f67a3c2eb9 selftest: confirm samba_dnsupdate works in both nsupdate and samba_tool mode
This can be extended, but already checks the basic functionality

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:14 +02:00
Andrew Bartlett
215c20b94b samba-tool domain join: Refuse to re-join a DC with a still-valid password
While the DC will eventually get back to the same state, it can take a
while, so try harder not to overwrite our already-working account

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:12 +02:00
Andrew Bartlett
2d79b61731 samba-tool: Improve fsmo handling
This makes a clear seperation between data and display variables
and improves the tests.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:12 +02:00
Andrew Bartlett
9173f2027c selftest: Rebase DrsBaseTestCase on SambaToolCmdTest
This then makes SambaToolCmdTest based on BlackboxTestCase.

This allows us to use better command output testing in the fsmo tests

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:12 +02:00
Ralph Boehme
721b21bb80 selftest: add test for DNS updates with TKEY/TSIG
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Jun 16 04:07:41 CEST 2016 on sn-devel-144
2016-06-16 04:07:41 +02:00
Andrew Bartlett
a8430d15a5 dsdb: Fix incorrect sorting of replPropertyMetaData with RDN last
Per tests against Windows 2012R2 the RDN is not sorted last and is
instead sorted normally with all the other elements.

The RDN attribute, unlike name, is not replicated over DRS, so this
has no interopability impact.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
db15993401 dbcheck: Find and fix a missing Deleted Objects container
Older Samba versions could delete this.  This patch tries very hard
to put back the original object, with the original GUID, so that
if another replica has the correct container, that we just merge
rather than conflict.

The existing "wrong dn" check can then put any deleted objects
under this container correctly.

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
ca2e038aa5 samba-tool domain join: Set drsuapi.DRSUAPI_DRS_GET_ANC during initial repl
This is needed so that we get parents before children.

We need this to ensure that we always know the correct parent for a
new child object, rather than just trusting the DN string

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Peter C. Kelly
b929008dc6 Improve help wording for samba-tool domain provision as per https://lists.samba.org/archive/samba-technical/2016-April/113740.html
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11894
Signed-off-by: Peter C. Kelly <peter+sambabugzilla@pck.co.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun  2 20:07:22 CEST 2016 on sn-devel-144
2016-06-02 20:07:22 +02:00
Andrew Bartlett
ea840010ee samba-tool domain demote: Fix error handling and error messages
Due to an error in a previous patch, e was undefined

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-02 16:36:15 +02:00
Rowland Penny
7583377473 samba-too: Allow 'samba-tool fsmo' to cope with empty or missing fsmo roles
samba-too: Allow 'samba-tool fsmo' to cope with empty or missing fsmo roles

Signed-off-by: Rowland Penny <rpenny@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2016-06-01 00:57:32 +02:00
Stefan Metzmacher
3aefd277f6 python:samba: move netcmd/time.py to python/samba/netcmd/nettime.py
This allows 'import time' to work.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu May 19 15:21:58 CEST 2016 on sn-devel-144
2016-05-19 15:21:58 +02:00
Douglas Bagnall
b3b2fee108 python/tests/dns_forwarder: fix for python 2.6
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue May 17 07:39:03 CEST 2016 on sn-devel-144
2016-05-17 07:39:03 +02:00
Andrew Bartlett
ac1ed18f8d classicupgrade: Avoid needing to quote CN values in an DN, use dn.set_component()
While invalid for samAccountName values, when also used for
samAccountName we should be dealing with this at the samldb layer, not
here.

This comes from unvalidated Samba3 data that can contain a , or =
without a problem in that codebase.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-05-11 03:47:04 +02:00
Douglas Bagnall
91f6439929 tests/dcerpc: add tests for string allocation and deletion
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue May 10 05:11:42 CEST 2016 on sn-devel-144
2016-05-10 05:11:42 +02:00
Douglas Bagnall
4c7a3fd567 tests/dcerpc/array.py: test deletion of arrays
We expect an AttributeError.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-05-10 01:43:15 +02:00
Andrew Bartlett
9e2c1f72e0 join.py: Fetch the remote DC NTDS GUID early
This avoids touching the LDAP connection after the long replicate cycle, as it may
have timed out

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-05-10 01:43:14 +02:00
Douglas Bagnall
4456f38612 python/join.py: Avoid unchecked print in error path
In autobuild this print causes an IOError when stdout is dead,
which hides the exception you care about and prevents the actual
clean up.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-05-10 01:43:14 +02:00
Garming Sam
26cfd75683 tests/dns_forwarder: Add additional testing for no flag recursive
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-05-03 08:10:10 +02:00
Garming Sam
97a7547a41 tests/dns_forwarder: Add an extra test for inactive forwarders
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-05-03 08:10:10 +02:00
Garming Sam
61f1eaf0b4 tests/dns_forwarder: remove statically defined IPs
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-05-03 08:10:09 +02:00
Garming Sam
2570f16497 tests/dns: Add additional testing of CNAME handling
RFC 1034, for instance, describes that all intermediate CNAMEs should be
returned. As it is, CNAME do not return all found intermediate results
in the case of straightforward failure. It should be noted that in the
case of forwarding success, ALL intermediate paths are returned,
including the failure ones.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-05-03 08:10:09 +02:00
Garming Sam
3b2f9f8756 tests/dns_forwarder: Add testing for DNS forwarding
The new tests show that single and multiple forwarders work as expected.
They also describe the behaviour encountered when the DNS server
encounters a CNAME from a forwarded request (which is not to pursue any
further).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-05-03 08:10:09 +02:00
Garming Sam
2ef0c9a8d4 dbcheck: Avoid pathological behaviour in operational module
Because replPropertyMetadata was repeated for every object in the
database, the attrs list became very long.

This single line saves 20% of the time for make test TESTS=dbcheck.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Wed Apr 20 09:12:47 CEST 2016 on sn-devel-144
2016-04-20 09:12:47 +02:00
Garming Sam
0619a83ccf tests/rodc: Check that preload will skip broken users
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Apr 18 07:40:07 CEST 2016 on sn-devel-144
2016-04-18 07:40:06 +02:00
Garming Sam
6d08b41676 rodc: Allow RODC preload to continue with invalid users
Either the user may be missing from the database, or the user is not
included in the RODC password replication group.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-04-18 03:53:23 +02:00
Stefan Metzmacher
4a53c8a588 CVE-2015-5370: python/samba/tests: add some dcerpc raw_protocol tests
These are independent from our client library and allow
testing of invalid pdus.

It can be used like this in standalone mode:

SMB_CONF_PATH=/dev/null SERVER=172.31.9.188 python/samba/tests/dcerpc/raw_protocol.py
or
SMB_CONF_PATH=/dev/null SERVER=172.31.9.188 python/samba/tests/dcerpc/raw_protocol.py -v -f TestDCERPC_BIND.test_invalid_auth_noctx

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:32 +02:00
Stefan Metzmacher
782e8e2abd CVE-2015-5370: python/samba/tests: add infrastructure to do raw protocol tests for DCERPC
These are independent from our client library and allow
testing of invalid pdus.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2016-04-12 19:25:32 +02:00
Stefan Metzmacher
85972a559f CVE-2016-2118: python:tests/dcerpc: use [sign] for dnsserver tests
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11616

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:27 +02:00
Rowland Penny
f777ca33c6 Bug 11818 : obvious missing word When trying to demote a dc, 'remove_dc.remove_sysvol_references' is sent 'remote_samdb, dc_name' , it expects 'remote_samdb, logger, dc_name'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11818

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Apr  1 22:54:22 CEST 2016 on sn-devel-144
2016-04-01 22:54:22 +02:00
Garming Sam
c37c4b18e0 CVE-2016-0771: tests/dns: Remove dependencies on env variables
Now that it is invoked as a normal script, there should be less of them.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:25 +01:00
Garming Sam
9f1ba00f1f CVE-2016-0771: tests/dns: change samba.tests.dns from being a unittest
This makes it easier to invoke, particularly against Windows.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:25 +01:00
Garming Sam
8cee2c8146 CVE-2016-0771: tests: rename test getopt to get_opt
This avoids any conflicts in this directory with the original toplevel
getopt.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:25 +01:00
Garming Sam
286b7a5e3f CVE-2016-0771: tests/dns: RPC => DNS roundtrip test
Make sure that TXT entries stored via RPC come out the same in DNS.

This has one caveat in that adding over RPC in Windows eats slashes,
and so fails there.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:25 +01:00
Garming Sam
ffec494826 CVE-2016-0771: tests/dns: modify tests to check via RPC
This checks that TXT records added over DNS, look the same over RPC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
2a796e5de7 CVE-2016-0771: tests/dns: Add some more test cases for TXT records
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
bbda6b6eda CVE-2016-0771: tests/dns: Correct error code for formerly unrun test
Both Samba and Windows returned NXRRSET

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
5b10cc25be CVE-2016-0771: tests/dns: restore formerly segfaulting test
This was on the client side, due the a strlen(NULL) on the previously
DOS-encoded TXT field. With a new IDL structure, this segfault no longer exists.
Note that both Samba and Windows return NXRRSET instead of FORMERR.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
866bf51758 CVE-2016-0771: tests/dns: Add a comment regarding odd Windows behaviour
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
a988dc7b2d CVE-2016-0771: tests/dns: FORMERR can simply timeout against Windows
Two requests with identical parameters which are poorly formatted, can
non-deterministically return FORMERR or simply fail to give a response.

Setting the timeout to a number allows Windows to succeed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
2ad53d1c07 CVE-2016-0771: tests/dns: prepare script for further testing
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Garming Sam
e09544de63 CVE-2016-0771: tests/dns: Modify dns tests to match new IDL
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Andrew Bartlett
c79c1e405d dbcheck: Check for and remove duplicate values in attributes
This can happen with three DCs and custom schema, but we test
it by just forcing the values directly into the backing tdb.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-08 01:58:30 +01:00
Andrew Bartlett
c36b2d7fb8 dbcheck: Avoid spurious warnings in dbcheck due to objectclass sorting
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11433
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-08 01:58:28 +01:00
Andrew Bartlett
5fb98a3534 dbcheck: Fix incorrect/duplicate attrid in replPropertMetaData
If custom schema is used in a replicated DC environment, these are created as soon as
an attribute is modified on more than one DC.  We have to remove these.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11443
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-08 01:58:28 +01:00
Andrew Bartlett
9e07f3a13b pidl: Fix our python reference handling
The new talloc.BaseObject allow us to hold a talloc context per
python object (there may be many referring to the same C object)
and the talloc context that the actual object pointer is under.

Another advantage is that talloc.BaseObject(), has less of
an ABI surface.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-08 01:58:26 +01:00