summaryrefslogtreecommitdiff
path: root/python
Commit message (Collapse)AuthorAgeFilesLines
* CVE-2018-14629 dns: CNAME loop prevention using counterAaron Haslett2018-11-281-0/+22
| | | | | | | | | | | Count number of answers generated by internal DNS query routine and stop at 20 to match Microsoft's loop prevention mechanism. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dns: prevent self-referencing CNAMEAaron Haslett2018-11-281-0/+44
| | | | | | | | | | | Stops the user from adding a self-referencing CNAME over RPC, which is an easy mistake to make with samba-tool. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* tests: Rework backup test inheritance to make LP constraints clearerTim Beale2018-11-272-14/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | The backup tests have a special constraint where we always want to use check_output() over runcmd(). The reason is we need the samba-tool backup/restore commands executed in a separate process. Otherwise the global underlying LoadParm can accumulate settings from earlier test case runs. We can avoid someone in future inadvertently running runcmd() by mistake, by simply changing the inheritance so we no longer inherit from SambaToolCmdTest (so the runcmd functions are no longer present). The comment explaining this has been moved to the top of the file. Note that the TestCaseInTempDir inheritance was redundant. BlackboxTestCase inherits from TestCaseInTempDir (and SambaToolCmdTest was inheriting from BlackboxTestCase). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Tim Beale <timbeale@samba.org> Autobuild-Date(master): Tue Nov 27 06:57:03 CET 2018 on sn-devel-144
* tests: Work out DOMSID via samdb rather than environsTim Beale2018-11-271-9/+7
| | | | | | | | | | | | | | | | | | | Not all testenvs have the DOMSID set as an environment variable. However, it's easy enough to work out from querying the samdb. This is a slight change in that we use a source4-generated loadparm to connect to the DB (self.lp is source3-generated, presumably for some SMB connection dependency). This change is so we can run the ntacls_backup tests against a DC with SMBv1 disabled (the restoredc). Note that currently the tests fail in the smb.SMB() connection in the setUp(), so we can't run them as part of autobuild just yet (because we can't known-fail test errors). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/test: PY3 port samba.tests.domain_backupNoel Power2018-11-271-3/+4
| | | | | | | | | | | | The restoredc already runs under python3, so before we can run the domain_backup tests against the restoredc, we need to make sure they work under python3. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Noel Power <noel.power@suse.com> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Handle backup command exceptions as test failures, not errorsTim Beale2018-11-272-1/+14
| | | | | | | | | | | | | | | | | | | | | | | If the backup command fails (i.e. throws an exception), we want the test to fail. This makes it easier to mark tests as 'knownfail' (because we can't knownfail test errors). In theory, this should just involve updating run_cmd() to catch any exceptions from the command and then call self.fail(). However, if the backup command fails, it can leave behind files in the targetdir. Partly this is intentional, as these files may provide clues to users as to why the command failed. However, in selftest, it causes the TestCaseInTempDir._remove_tempdir() assertion to fire. Because this assert actually gets run as part of the teardown, the assertion gets treated as an error rather than a failure (and so we can't knownfail the backup tests). To get around this, we remove any files in the tempdir prior to calling self.fail(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Rework backup test_backup_invalid_args test-caseTim Beale2018-11-271-6/+9
| | | | | | | | | | | | | | | self.create_backup() uses self.run_cmd(), which is a wrapper around self.check_output(). Rework the code to call the underlying check_output() function directly instead. The reason we're doing this is we want run_cmd() to catch exceptions and fail the test (i.e. in the next patch). However, we can't do that because this test case relies on receiving the exceptions. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool processes: display pre-fork masters and workersGary Lockyer2018-11-231-6/+69
| | | | | | | | | | | | | | | | | | | | | | | | Tag prefork work processes with "(worker 0)", and sort the process list on server name to get a consistent order. Service: PID -------------------------------------- cldap_server 15588 ... ldap_server 15584 ldap_server(worker 0) 15627 ldap_server(worker 1) 15630 ldap_server(worker 2) 15632 ldap_server(worker 3) 15634 nbt_server 15576 notify-daemon 15638 ... samba 0 ... wrepl_server 15580 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd test: prefork process restartGary Lockyer2018-11-231-0/+467
| | | | | | | | Add tests for the restarting of failed/terminated process, by the pre-fork process model. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* logger: use color automatically for a ttyJoe Guo2018-11-211-2/+5
| | | | | | | | | Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Nov 21 10:46:20 CET 2018 on sn-devel-144
* samba-tool ldapcmp: print DNs on predictable orderDouglas Bagnall2018-11-211-2/+2
| | | | | | | Rather than unstable hash order. Ideally we'd do them in proper DN order. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: make code pythonicJoe Guo2018-11-211-11/+6
| | | | | | Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: promote re object to globalJoe Guo2018-11-211-7/+5
| | | | | | | | Then we can reuse the re obj. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: use set instead of list to compare attrsJoe Guo2018-11-211-31/+22
| | | | | | | | This will simplify the logic and improve performance. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: fix wrong way for string copyJoe Guo2018-11-211-4/+4
| | | | | | | | | | | Two mistakes here: - res[:-1] will copy but lost the last char - string is immutable in python, there is no need to copy it explicitly Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: pass --skip-missing-dn to LDAPBaseJoe Guo2018-11-211-2/+2
| | | | | | | | | | | | | This option has default value False, and was actually not passed down from cli to LDAPBase. However, LDAPBase.__init__ has default value True for it. After the change, a few tests using ldapcmp are affected. Add --skip-missing-dn explicitly to keep the behavior consistent, otherwise test will fail. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: avoid modifying data while looping on dictJoe Guo2018-11-211-5/+7
| | | | | | | | | Just define another dict for return value, seems no need to modify original dict. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: rm unused global var summaryJoe Guo2018-11-211-6/+0
| | | | | | Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: use set instead of list to find missing DNsJoe Guo2018-11-211-49/+30
| | | | | | | | This simplify the logic and improve performance a lot. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: avoid list comprehension in for loopJoe Guo2018-11-211-2/+6
| | | | | | | | | The list comprehension will repeat for each item. For large database, this make the command freeze. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: add choices arg to --view optionJoe Guo2018-11-211-3/+1
| | | | | | | | So we don't need to validate ourselves. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: add choices arg to --scope optionJoe Guo2018-11-211-3/+1
| | | | | | | | So we don't need to validate ourselves. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: rename __eq__ to diffJoe Guo2018-11-211-2/+2
| | | | | | | | | | This method actually changed both objects and print info. __eq__ is not a proper name and is not designed for this case. Rename to diff. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd/ldapcmp: fix typo for BundleJoe Guo2018-11-211-4/+4
| | | | | | | | Bundel -> Bundle Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests samr: Extra tests for samr_EnumDomainUserssGary Lockyer2018-11-201-0/+144
| | | | | | | | Add extra tests to test the content returned by samr_EnumDomainUsers, and tests for the result caching added in the following commit. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* test samr: Extra tests for samr_EnumDomainGroupsGary Lockyer2018-11-201-0/+169
| | | | | | | | Add extra tests to test the content returned by samr_EnumDomainGroups, and tests for the result caching added in the following commit. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests samr: remove PEP8 warningsGary Lockyer2018-11-201-2/+4
| | | | | | | Remove PEP8 warnings from the samr tests. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests samr: Extra tests for samr_QueryDisplayInfoGary Lockyer2018-11-201-1/+389
| | | | | | | | | Add extra tests to test the content returned by samr_QueryDisplayInfo, which is not tested for the ADDC. Also adds tests for the result caching added in the following commit. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* sync_passwords: Remove dirsync cookie logging for continuous operationGarming Sam2018-11-201-1/+2
| | | | | | | | | | | Under normal operation, users shouldn't see giant cookies in their logs. We still log the initial cookie retrieved from the cache database, which should still be helpful for identifying corrupt cookies. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13686 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Flush replUpToDateVector when restoring offline backupTim Beale2018-11-201-4/+34
| | | | | | | | | | | | | | | | | | | | | The replUpToDateVector could be incorrect after an offline backup was restored. This means replication propagation dampening doesn't work properly. In the worst case, a singleton DC would have no replUpToDateVector at all, and so *all* objects created on that DC get replicated every time a new DRS connection is established between 2 DCs. This becomes a real problem if you used that singleton DC to create 100K objects... This patch flushes the replUpToDateVector when an offline backup gets restored. We need to do this before we add in the new DC and remove the old DCs. Note that this is only a problem for offline backups. The online/rename backups are received over DRS, and as part of the replication they receive the latest replUpToDateVector from the DC being backed up. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Small backup refactor to avoid compatiblity problemsTim Beale2018-11-201-3/+20
| | | | | | | | | | It will be easy to forget that the backupType marker doesn't exist on v4.9. However, this seems like a dumb reason not to support v4.9 backup-files. Add a wrapper function to avoid potential problems cropping up in future. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netcmd: Add backupType marker to backed-up DBTim Beale2018-11-201-10/+23
| | | | | | | | | | | | | | | | | We are starting to hit restore cases that are only applicable to a particular type of backup. We already had a marker to differentiate renames, but differentiating offline backups would also be useful. Note that this raises a slight compatibility issue for backups created on v4.9, as the marker won't exist. However, it's only offline backups we will use this marker for (at the moment), and this option doesn't exist on v4.9, so there's no problem. Removing the markers has been refactored out into a separate function to handle the optional presence of the new marker. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Add assertion that replUpToDateVector is present after backupTim Beale2018-11-201-5/+26
| | | | | | | | | We noticed that offline backups were missing a replUpToDateVector for the original DC, if the backup was taken on a singleton DC. This patch adds an assertion to the existing test-cases to highlight the problem. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/tests: Ensure samba_dnsupdate called with correct python versionNoel Power2018-11-141-1/+2
| | | | | | | | We need to examine the contents of PYTHON env variable which should defined the python version to be used when running tests. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/tests: PY3 Fix str/bytes issue for json.loadsNoel Power2018-11-141-2/+2
| | | | | | | | | | | | | | Python 3.4 seems to need a string parsed = json.loads (out_jsobj) File "/usr/lib/python3.4/json/__init__.py", line 312, in loads s.__class__.__name__)) TypeError: the JSON object must be str, not 'bytes' however Python 3.5 seems to be happy to consume bytes (or string) Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba: PY3 fix can't compare string with intNoel Power2018-11-141-3/+0
| | | | | | | | | Testing a string against an int value is illegal and is not necessary in this case, this patch removes the problematic test. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/netcmd: PY3 port samba4.blackbox.ldapcmp_restoreNoel Power2018-11-141-0/+1
| | | | | | Convert attribute from bytes to str Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/netcmd: PY3 port samba.tests.samba_tool.editNoel Power2018-11-141-1/+1
| | | | | | | Need to write bytes to file Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/tests: PY3 port samba.tests.blackbox.netads_jsonNoel Power2018-11-141-1/+2
| | | | | | convert output from check_output to text Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/tests: Port samba.tests.blackbox.samba_dnsupdate for PY2/PY3Noel Power2018-11-141-10/+11
| | | | | | | | | | Make sure either the output of tests and/or the item we are searching match in type. Output of cmd in python3 is bytes, depending on the was the test is written it may be easier just to convert all output or just a single string that is used in the test Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* testprogs/blackbox: PY3 bulk change for python scripts use correct pythonNoel Power2018-11-141-3/+3
| | | | | | | | Change all instance where python scripts are called so that the correct python version as specified by $PYTHON is used Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/samba/provision: PY3 port samba4.dlz_bind9.versionNoel Power2018-11-141-3/+4
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* mdb_util: Better error message if lmdb-utils not installedTim Beale2018-11-091-0/+7
| | | | | | | | | | | | | | | | | | | mdb_copy() was dutifully checking the PATH for the mdb_copy executable, then, if it didn't find it, blindly proceeding anyway and trying to run a non-existent executable. This resulted in a cryptic error: ERROR(<type 'exceptions.OSError'>): uncaught exception - [Errno 2] No such file or directory Add in an extra check that we actually find the executable and raise a better human-readable exception if we don't. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Nov 9 21:07:47 CET 2018 on sn-devel-144
* debug: Use debuglevel_(get|set) functionAndreas Schneider2018-11-081-2/+3
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Nov 8 11:03:11 CET 2018 on sn-devel-144
* traffic_replay: Rework machine accounts to remove redundant codeTim Beale2018-11-071-55/+5
| | | | | | | | | | | | | | | generate_users_and_groups() now generates the machine acounts as well as the user accounts, so it seems there's no need to also have generate_traffic_accounts(), which does the same job. Instead, we can just pass through the number of machine acounts to generate_users_and_groups() and delete the other function. Also updated generate_users_and_groups() so that machine_accounts is no longer optional (we want to create machine accounts in all cases). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* traffic_replay: Make packet generation work on a pre-populated DB againTim Beale2018-11-071-3/+13
| | | | | | | | | | | | | | | | | Generate separate machine accounts for populating a large DB vs replaying network traffic. We want to use different userAccountControl flags in each of the above cases (i.e. commit 3338a3e257fa9f28). However, this means that once you use the --generate-users-only option, you can't replay network packets against the machine accounts. We can avoid this problem by creating separate machine accounts for each of 2 different cases, e.g. STGM-0-x machines for traffic-replay, and PC-0-x machines for padding out the database. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* traffic_replay: Make sure naming assumptions are in a single placeTim Beale2018-11-071-7/+11
| | | | | | | | | | The traffic_replay group/user/machine account names follow a standard format. This adds a function to generate the machine-name. It also makes sure the existing user_name() function gets called in all applicable places. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* traffic_replay: Move 'traffic account' flag up a levelTim Beale2018-11-071-4/+7
| | | | | | | | | | | | | | | | | | We create machine accounts for 2 different purposes: 1). For traffic generation, i.e. testing realistic network packets. 2). For generating a realistic large DB. Unfortunately, we want to use different userAccountControl flags for the 2 different cases. Commit 3338a3e257fa9f28 changed the flags used for case #2, but this breaks case #1. The problem is generate_users_and_groups() is called in both cases, so we want the 'traffic account' flag passed into that function. This ensures that the machine accounts get created with the appropriate userAccountControl flags for the particular case you want to test. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* traffic_replay: Move machine account creationTim Beale2018-11-071-7/+7
| | | | | | | | | | | | | I was assuming that generate_users_and_groups() only gets called in the --generate-users-only case. However, it also gets called in the default traffic replay case. This patch reworks the code so that the number of machine accounts to create gets passed in, and the 'create 25% more computers than users' assumption only applies to the --generate-users-only case. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool gpo: convert pseudo-method into methodDouglas Bagnall2018-11-071-24/+23
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status