summaryrefslogtreecommitdiff
path: root/python
Commit message (Collapse)AuthorAgeFilesLines
* samba-tool gpo: clean up tmpdir after createDouglas Bagnall2022-08-061-0/+4
| | | | | | | | | | | | | 'fetch' and 'backup' might also leave files in /tmp, but in those cases we want the files. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15006 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@suse.com> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Sat Aug 6 01:42:09 UTC 2022 on sn-devel-184
* samba-tool: allow testparm to dump global section onlyDouglas Bagnall2022-08-061-1/+4
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15070 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@suse.com>
* pytest/netcmd: test samba-tool testparm global sectionDouglas Bagnall2022-08-061-0/+8
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@suse.com>
* CVE-2022-32743 tests/py_credentials: Add tests for setting dNSHostName with ↵Joseph Sutton2022-07-281-2/+279
| | | | | | | | | | | | LogonGetDomainInfo() Test that the value is properly validated, and that it can be set regardless of rights on the account. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14833 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* py/uptodateness: more details in missing dn reportDouglas Bagnall2022-07-281-1/+1
| | | | | | | | | | | | This does not fix bug 15127, but it improves reporting. https://bugzilla.samba.org/show_bug.cgi?id=15127 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jul 28 06:18:43 UTC 2022 on sn-devel-184
* CVE-2022-2031 tests/krb5: Add test that we cannot provide a TGT to kpasswdJoseph Sutton2022-07-271-0/+28
| | | | | | | | | | | The kpasswd service should require a kpasswd service ticket, and disallow TGTs. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Test truncated forms of server principalsJoseph Sutton2022-07-271-3/+27
| | | | | | | | | We should not be able to use krb@REALM instead of krbtgt@REALM. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Add tests for kpasswd serviceJoseph Sutton2022-07-274-1/+1033
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Consider kadmin/* principals as TGS for MIT KRB5 ↵Joseph Sutton2022-07-272-5/+28
| | | | | | | | | | | | | | | >= 1.20 With MIT Kerberos >= 1.20, we should not expect a ticket checksum in tickets to principals such as kpasswd/changepw, as they are encrypted with the krbtgt's key. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Add kpasswd_exchange() methodJoseph Sutton2022-07-271-13/+251
| | | | | | | | | | | Now we can test the kpasswd service from Python. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Allow requesting a TGT to a different sname and realmJoseph Sutton2022-07-271-6/+13
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* tests/krb5: Add option for creating accounts with expired passwordsJoseph Sutton2022-07-271-2/+8
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* tests/krb5: Fix enum typoJoseph Sutton2022-07-271-2/+2
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Add methods to send and receive generic messagesJoseph Sutton2022-07-271-17/+27
| | | | | | | | | | | | This allows us to send and receive kpasswd messages, while avoiding the existing logic for encoding and decoding other Kerberos message types. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Add 'port' parameter to connect()Joseph Sutton2022-07-271-5/+6
| | | | | | | | | | | This allows us to use the kpasswd port, 464. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Add methods to create ASN1 kpasswd structuresJoseph Sutton2022-07-271-0/+95
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Add new definitions for kpasswdJoseph Sutton2022-07-273-1/+31
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-32744 tests/krb5: Correctly calculate salt for pre-existing accountsJoseph Sutton2022-07-272-0/+2
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-2031 tests/krb5: Split out _make_tgs_request()Joseph Sutton2022-07-272-84/+85
| | | | | | | | | This allows us to make use of it in other tests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-32744 tests/krb5: Correctly handle specifying account kvnoJoseph Sutton2022-07-271-1/+1
| | | | | | | | | The environment variable is a string, but we expect an integer. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* gpo: samba-gpupdate use s3 param for registry confDavid Mulder2022-07-222-6/+10
| | | | | | | | | | | Cause samba-gpupdate to use an s3 param so that it can load settings from registry configuration. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Jul 22 20:40:51 UTC 2022 on sn-devel-184
* samba-tool user: Accomodate missing unicodePwd in getpassword commandJoseph Sutton2022-06-261-9/+29
| | | | | | | | | | To allow for the NT hash not being stored when NTLM authentication is disabled, we use the AES256 key instead for verification against the other packages if the unicodePwd attribute is not present. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool user: When possible, obtain AES256 key and saltJoseph Sutton2022-06-261-13/+26
| | | | | | | | | We will make use of these in the next commit to check that the supplemental packages are up-to-date with the current password. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/krb5: Add test for presence of NT hashJoseph Sutton2022-06-263-3/+149
| | | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3/client: fix dfs deltree, resolve dfs pathNoel Power2022-06-171-8/+0
| | | | | | | | | | | | | | | | | | | | since 4cc4938a2866738aaff4dc91550bb7a5ad05d7fb do_list seems to deal with non dfs root path, hence we need to resolve the path before calling cli_unlink. Also remove the knownfail We additionally have to also remove the fallback to remove 'file3' int the smbcacls_dfs_propagate_inherit.teardown as the deltree that happens in the baseclass now succeeds. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15100 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Jun 17 17:12:07 UTC 2022 on sn-devel-184
* tests: adapt logging test for s3.Douglas Bagnall2022-06-171-3/+11
| | | | | | | | | | | | | There is one knownfail, where it seems an smb.conf like log file = foo log level = 2 tdb:2@baa ldb:3 will send the ldb logs to 'baa' instead of 'foo' (i.e., the last opened log file, rather than the default log file). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: test source4 cmdline/smb.conf log levelDouglas Bagnall2022-06-171-0/+373
| | | | | | | | | | | | | | The 'log level' line in smb.conf allows messages from different log classes to be sent to different places, but we have not tested that this works. Now we do, somewhat. The test involves running a special binary based on a stripped down source4/samba/server.c that just starts up, parses the command line and a given smb.conf, then logs messages from multiple classes and exits. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Make RBCD access check less strictJoseph Sutton2022-06-141-1/+1
| | | | | | | | | | | Windows only requires SEC_ADS_CONTROL_ACCESS for the check to pass. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jun 14 15:38:23 UTC 2022 on sn-devel-184
* tests/krb5: Use object() rather than auto() to initialise enumsJoseph Sutton2022-06-141-5/+5
| | | | | | | | | | | | This ensures that when an enum value is expected, a magic constant won't be supplied instead. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jun 14 08:18:06 UTC 2022 on sn-devel-184
* python: Don't use deprecated escape sequencesJoseph Sutton2022-06-141-1/+1
| | | | | | | | Certain escape sequences are not valid in Python string literals, and will eventually result in a SyntaxError. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* libcli:util: Update werror tableJoseph Sutton2022-06-141-4/+1
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* spelling: connnect encrytion exisit expection explicit invalide missmatch ↵Michael Tokarev2022-06-101-2/+2
| | | | | | | | | | | | | | | | | | paramater paramter partion privilige relase reponse seperate unkown verson authencication progagated Tree-wide spellcheck for some common misspellings. source3/utils/status.c has misspelled local variable (unkown_dialect). "missmatch" is a known historical misspelling, only the incorrect misspellings are fixed. source3/locale/net/de.po has the spelling error (unkown) in two msgids - it probably should be updated with current source. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* lib/smbconf: expose smbconf error codes to python wrapperJohn Mulligan2022-06-081-0/+21
| | | | | | | | | | | | | | | | | | | | The smbconf library defines an enum of error codes that can be returned from the C calls. The error codes were getting stored in the python SMBConfError type but it was not easy to access or obvious what the integer code represented. This change makes it easier to get the returned error code: via a `error_code` attribute on the exception value. It also exposes the integer constants to the module. Simple tests for a few of the more obvious error codes check that this new error handling correctly exposes the error code values. Signed-off-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Wed Jun 8 13:13:10 UTC 2022 on sn-devel-184
* selftests: Convert "net ads dns async" test to pythonSamuel Cabrero2022-06-041-0/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current test uses the dig tool from bind9 but this tool has been rewritten in 9.17.7 to use bind's netmgr functions instead of isc_socket (commit 94b7988efb0f9b96415dd2966e6070450d960263). The problem is that these 'netmgr' functions use libuv internally, and, on systems supporting it, they end up using the sendmmsg() syscall which is not catched by socket wrapper so the test fails. This commit converts the test to python and uses the dnspython module instead of the dig tool. Backtraces follow as reference. Backtrace from dig v9.16.28 (working): #0 0x00007ffff778edee in sendmsg () from /lib64/libc.so.6 #1 0x00000000005e5dee in cmsgsend (s=s@entry=12, level=level@entry=0, type=type@entry=1, res=<optimized out>) at net.c:515 #2 0x00000000005e616c in try_dscp_v4 () at net.c:623 #3 try_dscp () at net.c:696 #4 0x00007ffff7708ad7 in __pthread_once_slow () from /lib64/libc.so.6 #5 0x00000000005e66d7 in initialize_dscp () at net.c:702 #6 isc_net_probedscp () at net.c:707 #7 0x00000000005e8460 in socket_create (manager=0x6b49c0, pf=2, type=<optimized out>, socketp=0x7ffff0012b00, dup_socket=0x0) at socket.c:2454 #8 0x000000000043cfcd in send_udp (query=0x7ffff00129a8) at dighost.c:2897 #9 0x000000000043f9c7 in onrun_callback (task=<optimized out>, event=<optimized out>) at dighost.c:4271 #10 0x00000000005dfefe in task_run (task=0x6b5c70) at task.c:851 #11 isc_task_run (task=0x6b5c70) at task.c:944 #12 0x00000000005ca0ce in isc__nm_async_task (worker=0x6b8970, ev0=0x716250) at netmgr.c:873 #13 process_netievent (worker=worker@entry=0x6b8970, ievent=0x716250) at netmgr.c:952 #14 0x00000000005ca2ba in process_queue (worker=worker@entry=0x6b8970, type=type@entry=NETIEVENT_TASK) at netmgr.c:1021 #15 0x00000000005caa43 in process_all_queues (worker=0x6b8970) at netmgr.c:792 #16 async_cb (handle=0x6b8cd0) at netmgr.c:821 #17 0x00007ffff7898a4d in ?? () from /lib64/libuv.so.1 #18 0x00007ffff78b4217 in ?? () from /lib64/libuv.so.1 #19 0x00007ffff789e40a in uv_run () from /lib64/libuv.so.1 #20 0x00000000005ca31e in nm_thread (worker0=0x6b8970) at netmgr.c:727 #21 0x00000000005e2315 in isc__trampoline_run (arg=0x6b7c40) at trampoline.c:198 #22 0x00007ffff7703767 in start_thread () from /lib64/libc.so.6 #23 0x00007ffff778dc10 in clone3 () from /lib64/libc.so.6 Backtrace from dig v9.17.7 (not working): #0 0x00007ffff7684480 in syscall () from /lib64/libc.so.6 #1 0x00007ffff754aed0 in uv__sendmmsg (vlen=0, mmsg=0x0, fd=10) at src/unix/linux-syscalls.c:163 #2 uv__udp_mmsg_init () at src/unix/udp.c:74 #3 0x00007ffff7606ad7 in __pthread_once_slow () from /lib64/libc.so.6 #4 0x00007ffff7541bd9 in uv_once (guard=<optimized out>, callback=<optimized out>) at src/unix/thread.c:440 #5 0x00007ffff7539e9b in uv__udp_sendmsg (handle=0x7ffff50535b8) at src/unix/udp.c:415 #6 uv__udp_send (send_cb=0x7ffff7a41db0 <udp_send_cb>, addrlen=<optimized out>, addr=<optimized out>, nbufs=1, bufs=0x7ffff506c720, handle=0x7ffff50535b8, req=0x7ffff506c878) at src/unix/udp.c:773 #7 uv_udp_send (req=req@entry=0x7ffff506c878, handle=handle@entry=0x7ffff50535b8, bufs=bufs@entry=0x7ffff506c720, nbufs=nbufs@entry=1, addr=<optimized out>, send_cb=send_cb@entry=0x7ffff7a41db0 <udp_send_cb>) at src/uv-common.c:464 #8 0x00007ffff7a42308 in udp_send_direct (peer=0x7ffff5dfa988, req=0x7ffff506c700, sock=0x7ffff5053000) at netmgr/udp.c:839 #9 isc__nm_async_udpsend (worker=<optimized out>, ev0=0x7ffff5dfa950) at netmgr/udp.c:780 #10 0x00007ffff7a47de7 in isc__nm_udp_send (handle=<optimized out>, region=0x7ffff5dfaa90, cb=0x555555566250 <send_done>, cbarg=<optimized out>) at netmgr/udp.c:749 #11 0x0000555555562ac2 in send_udp (query=0x7ffff502a000) at /usr/src/debug/bind-9.18.2-1.1.x86_64/bin/dig/dighost.c:2899 #12 udp_ready (handle=0x7ffff5026180, eresult=ISC_R_SUCCESS, arg=<optimized out>) at /usr/src/debug/bind-9.18.2-1.1.x86_64/bin/dig/dighost.c:2974 #13 0x00007ffff7a37d34 in isc__nm_async_connectcb (worker=worker@entry=0x7ffff622f000, ev0=ev0@entry=0x7ffff5026480) at netmgr/netmgr.c:2704 #14 0x00007ffff7a3ca20 in process_netievent (worker=worker@entry=0x7ffff622f000, ievent=0x7ffff5026480) at netmgr/netmgr.c:940 #15 0x00007ffff7a3d027 in process_queue (worker=worker@entry=0x7ffff622f000, type=type@entry=NETIEVENT_NORMAL) at netmgr/netmgr.c:977 #16 0x00007ffff7a3d203 in process_all_queues (worker=0x7ffff622f000) at netmgr/netmgr.c:733 #17 async_cb (handle=0x7ffff622f360) at netmgr/netmgr.c:762 #18 0x00007ffff7531a4d in uv__async_io (loop=0x7ffff622f010, w=<optimized out>, events=<optimized out>) at src/unix/async.c:163 #19 0x00007ffff754d217 in uv__io_poll (loop=0x7ffff622f010, timeout=<optimized out>) at src/unix/epoll.c:374 #20 0x00007ffff753740a in uv__io_poll (timeout=<optimized out>, loop=0x7ffff622f010) at src/unix/udp.c:122 #21 uv_run (loop=loop@entry=0x7ffff622f010, mode=mode@entry=UV_RUN_DEFAULT) at src/unix/core.c:391 #22 0x00007ffff7a3d624 in nm_thread (worker0=0x7ffff622f000) at netmgr/netmgr.c:664 #23 0x00007ffff7a6c915 in isc__trampoline_run (arg=0x555555599210) at /usr/src/debug/bind-9.18.2-1.1.x86_64/lib/isc/trampoline.c:187 #24 0x00007ffff7601767 in start_thread () from /lib64/libc.so.6 #25 0x00007ffff768bc10 in clone3 () from /lib64/libc.so.6 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Jun 4 00:27:29 UTC 2022 on sn-devel-184
* gpo: Move Group Policy code below gp directoryDavid Mulder2022-05-3125-55/+55
| | | | | | | | | | | | | Moves the Group Policy extensions and supporting code within the existing python/samba/gp directory. Meant to clean up the clutter that's accumulating in python/samba. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue May 31 20:15:45 UTC 2022 on sn-devel-184
* py:gpo: Fix testing of 0x8000 bitPavel Filipenský2022-05-261-3/+3
| | | | | | | | | Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Thu May 26 19:36:52 UTC 2022 on sn-devel-184
* python/gp_cert_auto_enroll: Fix bitwise test in expressionPavel Filipenský2022-05-231-3/+3
| | | | | | | | | | Found by covscan. result_independent_of_operands: "(e.data & 4) == 1" is always false regardless of the values of its operands. This occurs as the operand of assignment. Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4/dlz: add support for bind 9.18Douglas Bagnall2022-05-231-1/+5
| | | | | | | | | | | | | | It seems nothing has changed since 9.16 for our purposes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14986 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Andreas Hasenack <andreas@canonical.com> Pair-programmed-with: Andreas Hasenack <andreas@canonical.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Mon May 23 00:53:09 UTC 2022 on sn-devel-184
* gpo: Cert Auto Enroll use ldap trust cert if NDES disabledDavid Mulder2022-05-131-6/+17
| | | | | | | | | | | | | If the CA does not have the Network Device Enrollment Service enabled, we can still use the certificate from the ldap request (unless this is a complex request and ldap config isn't present). Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri May 13 15:38:53 UTC 2022 on sn-devel-184
* gpo: Fix Cert Auto Enroll docstringsDavid Mulder2022-05-131-25/+28
| | | | | | These were flagged by pydocstyle. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* gpo: Remove sscep depends from Cert Auto EnrollDavid Mulder2022-05-133-61/+125
| | | | | | | | | Certificate Auto Enrollment currently depends on sscep to retrieve the root certificate chain. This isn't necessary, since this can be accomplished with a simple GET. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* gpo: Halt Cert Auto Enroll process if data corruptedDavid Mulder2022-05-121-0/+1
| | | | | | | | | | | | | If the CA URL cannot be processed, then halt processing. Otherwise we'll end up in a broken state later when trying to read from the end points with missing data. Signed-off-by: David Mulder <dmulder@suse.com> Revewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu May 12 18:45:41 UTC 2022 on sn-devel-184
* gpo: Supress error caused by ldap Cert Auto Enroll configDavid Mulder2022-05-121-1/+1
| | | | | | | | | | | | | When the CA url specified on the SYSVOL is 'LDAP:' this means that configuration should be fetched from LDAP. This corrects an error message that was being reported when the URL appeared improper but really is not. This does not change the code behavior (it was still working), but removes the invalid error. Signed-off-by: David Mulder <dmulder@suse.com> Revewed-by: Andreas Schneider <asn@samba.org>
* tests/user_check_password_script: Don't try to delete user after failed addJoseph Sutton2022-05-101-4/+0
| | | | | | | The user account should not exist if account creation failed. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/user_check_password_script: Remove unused importsJoseph Sutton2022-05-101-6/+0
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samdb: Avoid half-created accountsJoseph Sutton2022-05-101-12/+35
| | | | | | | | | | If newuser() or newcomputer() create an account over LDAP, and an attempt to modify it (e.g. to change the password) fails, ensure that we properly clean up the account. If we are connected over LDAP, we won't have transactions to clean things up for us. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/samba-tool user: Add test for adding a user over LDAPJoseph Sutton2022-05-101-1/+40
| | | | | | | Ensure that we do not end up with half-created accounts. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/samba-tool user_wdigest: Check command resultsJoseph Sutton2022-05-101-5/+13
| | | | | | | | Ensure that the commands to create and delete the user execute successfully. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/samba-tool user_wdigest: Add accounts to local databaseJoseph Sutton2022-05-101-6/+1
| | | | | | | | Adding accounts over LDAP means transactions cannot be used, potentially leading to problems. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/samba-tool user_wdigest: Fix flapping testJoseph Sutton2022-05-101-37/+31
| | | | | | | | | | | The randomly-generated password for the user account may be too weak, causing account creation to fail. This leads to further problems, as the result of the command is not checked, and connecting over LDAP means transactions cannot be used, leading to a half-created account and failing tests. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status