sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Code
127,413 Commits 60 Branches 1,144 Tags 452 MiB
e7c39cc44f
Commit Graph

3069 Commits

Author SHA1 Message Date
Joseph Sutton
4c67a53cdc tests/krb5: Simplify adding authdata to ticket by using modified_ticket() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-23 18:32:29 +00:00
Joseph Sutton
1fcde7cb6c tests/krb5: Add method for modifying a ticket and creating PAC checksums 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-23 18:32:29 +00:00
Joseph Sutton
12b5e72a35 tests/krb5: Add method to verify ticket PAC checksums 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-23 18:32:29 +00:00
Joseph Sutton
ec95b3042b tests/krb5: Add RodcPacEncryptionKey type allowing for RODC PAC signatures 
Signatures created by an RODC have an RODCIdentifier appended to them
identifying the RODC's krbtgt account.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Sep 21 23:55:39 UTC 2021 on sn-devel-184
 2021-09-21 23:55:39 +00:00
Joseph Sutton
a562882b15 tests/krb5: Add methods for creating zeroed checksums and verifying checksums 
Creating a zeroed checksum is needed for signing a PAC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:42 +00:00
Joseph Sutton
419e4061ce tests/krb5: Cache obtained tickets 
Now tickets obtained with get_tgt() and get_service_ticket() make use of
a cache so they can be reused, unless the 'fresh' parameter is specified
as true.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
6193f7433b tests/krb5: Return encpart from get_tgt() as part of KerberosTicketCreds 
The encpart is already contained in ticket_creds, so it no longer needs
to be returned as a separate value.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
59c1043be2 tests/krb5: Move get_tgt() and get_service_ticket() to kdc_base_test 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
035a8f1985 tests/krb5: Allow get_tgt() to specify expected and unexpected flags 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
4ecfa82e71 tests/krb5: Allow get_tgt() to specify different kdc-options 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
2d69805b1e tests/krb5: Allow get_tgt() to get tickets from the RODC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
5d3a135c23 tests/krb5: Allow get_service_ticket() to get tickets from the RODC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
7645dfa5be tests/krb5: Set DN of created accounts to ldb.Dn type 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
c226029655 tests/krb5: Don't manually create PAC request and options in fast_tests 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
3504e99dc5 tests/krb5: Use PAC buffer type constants from krb5pac.idl 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
a5e62d681d tests/krb5: Allow as_req() to specify different kdc-options 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
6403a09d94 tests/krb5: Allow tgs_req() to send requests to the RODC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
1a3426da54 tests/krb5: Allow tgs_req() to specify different kdc-options 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
1f0654b8fa tests/krb5: Allow tgs_req() to send additional padata 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
2a4d53dc12 tests/krb5: Refactor tgs_req() to use _generic_kdc_exchange 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
0061fa2c2a tests/krb5: Check correct flags element 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
a281ae09bc tests/krb5: Add helper method for modifying PACs 
This method can remove or replace a PAC in an authorization-data
container, while additionally returning the original PAC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
21a7717359 python/join: Check for correct msDS-KrbTgtLink attribute 
Previously, the wrong case was used when checking for this attribute,
which meant krbtgt accounts were not being cleaned up.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
cde38d36b9 python: Don't leak file handles 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2021-09-21 23:05:41 +00:00
Joseph Sutton
35292bd322 tests/krb5: Allow replicating accounts to the created RODC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
ef5666bc51 tests/krb5: Create RODC account for testing 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
3cc9e77f38 tests/krb5: Allow replicating accounts to the RODC 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
af633992e3 tests/krb5: Add get_secrets() method to get the secret attributes of a DN 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
a5bf7aad54 tests/krb5: Add method to get RODC krbtgt credentials 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
7bc52cecb4 tests/krb5: Sign-extend kvno from 32-bit integer 
This helps to avoid problems with RODC kvnos that have the high bit set.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
a99a76722d pytest:segfault: Add test for ldb.msg_diff() 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
943079fd94 tests/krb5: Generate padata for FAST tests 
This gives us access to parameters of kdc_exchange_dict and enables us
to simplify the logic.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
c9fd8ffd89 tests/krb5: Add get_cached_creds() method to create persistent accounts for testing 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
0e99382d73 tests/krb5: Get encpart decryption key from kdc_exchange_dict 
Instead of using check_padata_fn to get the encpart decryption key, we
can get the key from the AS-REQ preauth phase or from the TGT, depending
on whether the message is an AS-REQ or a TGS-REQ. This allows removal of
check_padata_fn and some duplicated code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
a5186f9280 tests/krb5: Get expected cname from TGT for TGS-REQ messages 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
4ba5e82ae5 tests/krb5: Allow specifying status code to be checked 
This allows us to check the status code that may be sent in an error
reply to a TGS-REQ message.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-15 07:59:31 +00:00
Joseph Sutton
01378a52a1 tests/krb5: Create testing accounts in appropriate containers 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Sep 14 00:01:44 UTC 2021 on sn-devel-184
 2021-09-14 00:01:44 +00:00
Joseph Sutton
c3b7462902 tests/krb5: Check for presence of 'key-expiration' element 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
d3106a8d35 tests/krb5: Check 'caddr' element 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
9cba5f9a1b tests/krb5: Check for presence of 'renew-till' element 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
0afb548a0a tests/krb5: Allow Kerberos requests to be sent to DC or RODC 
If run inside the 'rodc' testing environment, 'DC_SERVER' and 'SERVER'
refer to the hostnames of the DC and RODC respectively, and this commit
allows either one of them to be used as the KDC for Kerberos exchanges.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
1974b872fb tests/krb5: Make time assertion less strict 
This assertion could fail if there was a time difference between the KDC
and the client.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
85ddfc1afc tests/krb5: Allow specifying ticket flags expected to be set or reset 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
571265257f tests/krb5: Remove magic constants 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
7556a4dfa6 tests/krb5: Don't create PAC request or options manually in fast_tests 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
bc21ba2592 tests/krb5: Don't create PAC request manually in as_req_tests 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
c0db1ba54d tests/krb5: add options to kdc_exchange_dict to specify including PAC-REQUEST or PAC-OPTIONS 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
1f23b16ef3 tests/krb5: Move padata generation methods to base class 
This allows them to be used directly from RawKerberosTest.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
9973b51e48 tests/krb5: Keep track of account DN in credentials object 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
9aa9008574 tests/krb5: Allow specifying additional User Account Control flags for account 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
7aae0e9b10 tests/krb5: Allow specifying an OU to create accounts in 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
bf55786fcd tests/krb5: Replace expected_cname_private with expected_anon parameter 
This is used in the case where the KDC returns 'WELLKNOWN/ANONYMOUS' as
the cname, and makes the reply checking logic easier to follow. This
also removes the need to fetch the client credentials in the test
methods.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
3fd73b65a3 tests/krb5: Use more compact dict lookup 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
08086c4398 tests/krb5: Add KDCOptions flag for constrained delegation 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
448b661bf8 tests/krb5: Use signed integers to represent key version numbers in ASN.1 
As specified in 'MS-KILE 3.1.5.8: Key Version Numbers', Windows uses
signed 32-bit integers to represent key version numbers. This makes a
difference for an RODC with a msDS-SecondaryKrbTgtNumber greater than
32767, where the kvno should be encoded in four bytes rather than five.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
9924dd9761 tests/krb5: Add methods to obtain the length of checksum types 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Joseph Sutton
c6badf818e tests/krb5: Calculate expected salt if not given explicitly 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
 2021-09-13 23:11:35 +00:00
Ralph Boehme
09fd46aa1c selftest: remove unsupported smbcacls option --get 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14828

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2021-09-10 15:10:30 +00:00
David Mulder
efba2c445c gpo: Add Chromium Group Policy 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Sep  9 20:42:35 UTC 2021 on sn-devel-184
 2021-09-09 20:42:35 +00:00
David Mulder
1047acce9d gpo: Test Chromium Group Policy 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2021-09-09 19:55:29 +00:00
Volker Lendecke
6ebed6b505 samba-tool: Fix a typo 
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2021-09-07 18:26:33 +00:00
Andrew Bartlett
6590bb0b77 selftest: Add prefix to new schema attributes to avoid flapping dsdb_schema_attributes 
If two of these unit tests run in the same second they could
select the same name, as the name was only based on the time
and a common prefix.

As observed by Jeremy Allison.  Thanks for the report!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14819

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Sep  6 02:32:51 UTC 2021 on sn-devel-184
 2021-09-06 02:32:51 +00:00
Andrew Bartlett
b40761b42e selftest: Add a test for LookupSids3 and LookupNames4 in python 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14807

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2021-09-05 02:28:29 +00:00
Joseph Sutton
b59fc43523 python: Fix usage strings 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2021-09-04 00:10:37 +00:00
Andrew Bartlett
10baaf0852 tests/krb5: Allow KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN for a missing sname 
This allows our code to still pass with the error code that
MIT and Heimdal have chosen

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Sep  2 14:28:31 UTC 2021 on sn-devel-184
 2021-09-02 14:28:31 +00:00
Joseph Sutton
ebd673e976 tests/krb5: Allow expected_error_mode to be a container type 
This allows a range of possible error codes to be checked against, for
cases when the particular error code returned is not so important.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
24914ae17d tests/krb5: Add tests for omitting sname in inner request 
Note: the test 'test_fast_tgs_inner_no_sname' crashes the MIT KDC.

This is fixed in MIT Krb5 commit d775c95af7606a51bf79547a94fa52ddd1cb7f49
and was given CVE-2021-37750

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
c6d7e19ecf tests/krb5: Allow specifying parameters specific to the inner FAST request body 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
bbbb13caf7 tests/krb5: Add tests for omitting sname in request 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
1e4d757394 tests/krb5: Check PADATA-PW-SALT element in e-data 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
e373c6461a tests/krb5: Check e-data element for TGS-REP errors without FAST 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Andrew Bartlett
3330eaf39c tests/krb5: Remove harmful and a-typical return in as_req testcase 
A test in a TestCase class should not return a value, the
test is determined by the assertions raised.

Other changes will shortly cause kdc_exchange_dict[preauth_etype_info2]
to not always be filled, so we need to remove this
rudundent code.

This also fixes a *lot* of tests against the MIT KDC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
b8e2515552 CVE-2021-3671 tests/krb5: Add tests for omitting sname in outer request 
Note: Without the previous patch, 'test_fast_tgs_outer_no_sname' would
crash the Heimdal KDC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
15f9f040fe tests/krb5: Add test for sending PA-ENCRYPTED-CHALLENGE without FAST 
Note: This test crashed the MIT KDC prior to MIT commit
fc98f520caefff2e5ee9a0026fdf5109944b3562 which was given
CVE-2021-36222.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
36798f5b65 tests/krb5: Make cname checking less strict 
Without this additional 'self.strict_checking' check, the tests in the
following patches do not get far enough to trigger a crash with the MIT
KDC.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Joseph Sutton
79dda329f2 tests/krb5: Make e-data checking less strict 
Without this additional 'self.strict_checking' check, the tests in the
following patches do not get far enough to trigger a crash with the MIT
KDC, instead failing when obtaining a TGT for the user or machine.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-09-02 13:41:28 +00:00
Andrew Bartlett
fb6c0b9e2a pydsdb: Add API to return strings of known UF_ flags 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2021-09-02 05:03:31 +00:00
David Mulder
d5118eb68a gpo: Add Group Policy Firefox Extension 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Aug 30 21:57:09 UTC 2021 on sn-devel-184
 2021-08-30 21:57:09 +00:00
David Mulder
c5bbb1777e gpo: Test Group Policy Firefox Extension 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
 2021-08-30 21:08:36 +00:00
Andrew Bartlett
78942ad7d1 samba-tool domain backup: Use tdbbackup on metadata.tdb 
metadata.tdb is inside sam.ldb.d/ but should be backed up with tdbbackup.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Aug 24 13:22:04 UTC 2021 on sn-devel-184
 2021-08-24 13:22:04 +00:00
Andrew Bartlett
958931ad37 samba-tool: Rework transations/locks to hold a lock during mdb backup 
We now also get sidForRestore under that lock, rather than
after the backup.

This avoids using the database again after the backup process

While not entirely clear how/why this matters with LMDB
as seen in Fedora 34, likely due to the same issues
seen with 0.9.26 or later fixed by commmit
bb3dcd403c.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-24 12:29:32 +00:00
Andrew Bartlett
423f808ff4 samba-tool domain backup offline: Use passed in samdb when backing up sam.ldb 
This avoids opening the database again by having the caller pass in
the DB open

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-24 12:29:32 +00:00
Joseph Sutton
984a0db00c tests/krb5: Add FAST tests 
Example command:

SERVER=addc STRICT_CHECKING=0 SMB_CONF_PATH=/dev/null \
KRB5_CONFIG=krb5.conf DOMAIN=ADDOMAIN REALM=ADDOM.SAMBA.EXAMPLE.COM \
ADMIN_USERNAME=Administrator ADMIN_PASSWORD=locDCpass1 \
PYTHONPATH=bin/python python/samba/tests/krb5/fast_tests.py

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 18 23:20:14 UTC 2021 on sn-devel-184
 2021-08-18 23:20:13 +00:00
Gary Lockyer
b7b62957bd initial FAST tests 
Currently incomplete, and tested only against MIT Kerberos.

[abartlet@samba.org
 Originally "WIP inital FAST tests"

 Samba's general policy that we don't push WIP patches, we polish
 into a 'perfect' patch stream.

 However, I think there are good reasons to keep this patch distinct
 in this particular case.

 Gary is being modest in titling this WIP (now removed from the title
 to avoid confusion). They are not WIP in the normal sense of
 partially or untested code or random unfinished thoughts. The primary
 issue is that at that point where Gary had to finish up he had
 trouble getting FAST support enabled on Windows, so couldn't test
 against our standard reference. They are instead good, working
 initial tests written against the RFC and tested against Samba's AD DC
 in the mode backed by MIT Kerberos.

 This preserves clear authorship for the two distinct bodies of work,
 as in the next patch Joseph was able to extend and improve the tests
 significantly. ]

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
aa2c221f4e tests/krb5: Check PADATA-FX-ERROR in reply 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
66e1eb58be tests/krb5: Allow generic_check_kdc_error() to check inner FAST errors 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
0c857f67a3 tests/krb5: Check PADATA-PAC-OPTIONS in reply 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
29070e74ba tests/krb5: Make generic_check_kdc_error() also work for checking TGS replies 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
ab4e7028a6 tests/krb5: Make check_rep_padata() also work for checking TGS replies 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
95b54078c2 tests/krb5: Check PADATA-FX-COOKIE in reply 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
2f7919db39 tests/krb5: Check PADATA-ENCRYPTED-CHALLENGE in reply 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
44a44109db tests/krb5: Adjust reply padata checking depending on whether FAST was sent 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
056fb71832 tests/krb5: Check reply FAST padata if request included FAST 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
7a27b75621 tests/krb5: Check sname is krbtgt for FAST generic error 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
dbe98005d5 tests/krb5: Add get_krbtgt_sname() method 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
5edbabeb26 tests/krb5: Remove unused variables 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
705e45e37f tests/krb5: Don't expect RC4 in ETYPE-INFO2 for a non-error reply 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
79b9aac65b tests/krb5: Add check_rep_padata() method to check padata in reply 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
1389ba346d tests/krb5: Add generate_simple_fast() method to generate FX-FAST padata 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00
Joseph Sutton
ea1ed63e88 tests/krb5: Include authdata in kdc_exchange_dict 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 2021-08-18 22:28:34 +00:00