summaryrefslogtreecommitdiff
path: root/selftest
Commit message (Collapse)AuthorAgeFilesLines
* s4:kdc: Add support for constructed claims (for authentication silos)HEADmasterJoseph Sutton2023-05-181-1/+0
| | | | | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu May 18 01:58:24 UTC 2023 on atb-devel-224
* s4:kdc: Enforce TGT lifetime authentication policyJoseph Sutton2023-05-182-42/+0
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/krb5: Add tests for authentication policiesJoseph Sutton2023-05-182-0/+215
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests/krb5: Test that NT_STATUS_ACCOUNT_LOCKED_OUT is returned in KDC reply ↵Joseph Sutton2023-05-182-0/+11
| | | | | | | | | e-data Certain clients rely on this behaviour. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* selftest: Change ad_dc environment to be 2016 functional levelAndrew Bartlett2023-05-161-2/+15
| | | | | | | This is not yet supported in full, but this makes ad_dc match our full set of available features. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* selftest: Allow provision_ad_dc() to take functional_level as an argumentAndrew Bartlett2023-05-161-5/+11
| | | | | | | The $$$$$$$ is removed as it does not do what you think it does. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* selftest: Return fl2008dc to being an alias for ad_dc_ntvfsAndrew Bartlett2023-05-161-12/+3
| | | | | | | | | The change to make this independent in fc9845da69cabcc1bf046d7899b2c4aeae743170 was incorrect, as no distinct name was specified so this would conflict with the ad_dc_ntvfs environment over the IP and name "localdc". Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* Use --base-schema=2008_R2 on ad_dc_ntvfs, which opeates at FL2008Andrew Bartlett2023-05-161-1/+3
| | | | | | | This will allow fl008dc to become an alias of ad_dc_ntvfs again. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* winbind: Fix "wbinfo -u" on a Samba AD DC with >1000 usersVolker Lendecke2023-05-091-1/+0
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15366 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue May 9 02:58:45 UTC 2023 on atb-devel-224
* winbind: Test wbinfo -u with more than 1000 usersVolker Lendecke2023-05-091-0/+1
| | | | | | | | | | | | | | | | | | | winbind asks dcerpc_samr_LookupRids in one batch, where samr.idl has NTSTATUS samr_LookupRids( [in,ref] policy_handle *domain_handle, [in,range(0,1000)] uint32 num_rids, [in,size_is(1000),length_is(num_rids)] uint32 rids[], [out,ref] lsa_Strings *names, [out,ref] samr_Ids *types ); limiting num_rids to 1000 entries. Test this. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15366 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3/utils: when encoding ace string use "FA", "FR", "FW", "FX" string rightsNoel Power2023-04-281-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | prior to this patch rights matching "FA", "FR", "FW", "FX" were outputted as the hex string representing the bit value. While outputting the hex string is perfectly fine, it makes it harder to compare icacls output (which always uses the special string values) Additionally adjust various tests to deal with use of shortcut access masks as sddl format now uses FA, FR, FW & FX strings (like icalcs does) instead of hex representation of the bit mask. adjust samba4.blackbox.samba-tool_ntacl samba3.blackbox.large_acl samba.tests.samba_tool.ntacl samba.tests.ntacls samba.tests.posixacl so various string comparisons of the sddl format now pass Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> [abartlet@samba.org Adapted to new stricter SDDL behaviour around leading zeros in hex numbers, eg 0x001]
* s3/utils: value for ace_flags value "FA" is incorrectNoel Power2023-04-281-1/+0
| | | | | | | | value for FA should be 0x001f01ff (instead of 0x00001ff) Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* pytest:sddl: show the correct handling of the "FA" SDDL flagAndrew Bartlett2023-04-281-0/+2
| | | | | | | | | | The "FA" flag should map to 0x1f01ff, and 0x1f01ff should be converted back into "FA". This will be fixed over the next couple of commits. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* pytest:sddl Samba had the wrong value for FA, now fix the testsAndrew Bartlett2023-04-281-3/+3
| | | | | | | | | | | | | The tests that were in SddlWindowsFlagsAreDifferent have the behaviour we want, and as we aim for Samba flags no longer being different, we shift them to SddlNonCanonical. The tests in SddlSambaDoesItsOwnThing are removed because they showed Samba's old behaviour around FA. This will create knownfails, which will be fixed by the commit fixing the value of "FA". Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* libcli:security:sddl: accept only 8-4-4-4-12 GUIDsDouglas Bagnall2023-04-281-3/+0
| | | | | | | | | | | | | | | | | | | | | | | Before we would take strings in a variety of lengths and formats, which is not what Windows does or [MS-DTYP] says. This was found by looking at evolved fuzz seeds. Note the 16 and 32 byte sequences in GUID position below: $ hd $(ls -t seeds/fuzz_sddl_parse/* | head -1)| head 00000000 44 3a 41 52 50 50 50 50 50 28 4f 4c 3b 3b 46 57 |D:ARPPPPP(OL;;FW| 00000010 3b 30 7e ff ff ff ff ff ff ff 2d 31 38 f5 ff ff |;0~.......-18...| 00000020 fb 3b 3b 52 43 29 28 4f 44 3b 3b 46 57 3b 3b 3b |.;;RC)(OD;;FW;;;| 00000030 52 43 29 28 4f 44 3b 3b 46 57 3b 30 30 ff ff ff |RC)(OD;;FW;00...| 00000040 fb 30 e9 9b 3c cf e6 f5 ff ff fb 3b 3b 52 43 29 |.0..<......;;RC)| 00000050 28 4f 44 3b 3b 46 57 43 52 3b 3b 3b 52 43 29 28 |(OD;;FWCR;;;RC)(| 00000060 4f 44 3b 3b 46 58 47 52 3b 3b 33 43 43 35 38 37 |OD;;FXGR;;3CC587| 00000070 32 35 44 44 44 44 44 44 44 44 44 44 44 44 44 44 |25DDDDDDDDDDDDDD| 00000080 44 44 44 44 44 44 44 44 44 44 3b 52 43 29 28 4f |DDDDDDDDDD;RC)(O| 00000090 44 3b 3b 46 58 3b 3b 3b 52 43 29 28 4f 44 3b 3b |D;;FX;;;RC)(OD;;| Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: test we only accept normal GUIDsDouglas Bagnall2023-04-281-2/+5
| | | | | | | | By normal GUID, I mean ones like f30e3bbf-9ff0-11d1-b603-0000f80367c1, with four hyphens and no curly braces. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli:security:sddl_decode_access allows spaces between flagsDouglas Bagnall2023-04-281-3/+0
| | | | | | | because Windows does. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: tests around spaces in access flags and SIDsDouglas Bagnall2023-04-281-0/+3
| | | | | | | | | | | | | It turns out that in accesss flags Windows will allow leading spaces and spaces separating flags but not trailing spaces. We choose to follow this in part because we found it happening in the wild in our tests for upgradeprovision until a few commits ago. Windows will also allow spaces in some parts of SIDs. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli:security: sddl_decode_ace: don't allow junk after SIDDouglas Bagnall2023-04-281-2/+0
| | | | | | | | sddl_decode_sid() will stop at the first non-SID character. Windows doesn't allow white space here, and nor do we. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: sddl_decode_access rejects trailing rubbishDouglas Bagnall2023-04-281-11/+0
| | | | | | | | | Before we just ignored things like negative numbers, because they'd end up being seen as not-numbers, so treated as flags, then as not-flags. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli:security: sddl_map_flags rejects trailing nonsenseDouglas Bagnall2023-04-281-1/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: add tests for long DACLs, differing flag interpretationsDouglas Bagnall2023-04-281-0/+3
| | | | | | | | Windows converts hex numbers into flags differently, and has different ideas of what constitutes "FA", and possibly others. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: let hex numbers differ in case (0xa == 0xA)Douglas Bagnall2023-04-281-1/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: SDDL strings where Windows behaviour differsDouglas Bagnall2023-04-281-0/+4
| | | | | | | | | | These ones we might want to match. They are understandable behaviours, like matching lowercase flags and coping with whitespace in some places. These tests are set up to document the differences without overwhelming the knownfails. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: Add negative tests of unparseable stringsDouglas Bagnall2023-04-281-0/+10
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sddl: split each string into it's own testDouglas Bagnall2023-04-281-1/+1
| | | | | | | This of course allows for fine-grained knownfails. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/sddl: split tests into canonical and non-canonicalDouglas Bagnall2023-04-281-1/+1
| | | | | | | | | | | | The examples in the canonical list are already in the form that Windows and Samba will use for that SD. We check the round trip. The examples in the non-canonical list will change in a round trip, so we also give the string we think they should end up as. These have been checked on Windows. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/sddl: rework to allow multiple lists, no early stopDouglas Bagnall2023-04-281-0/+1
| | | | | | | The test will fail right now because it makes round trip assertions. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:posixacl: expect canonical ACE flag formatDouglas Bagnall2023-04-281-78/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:samba-tool ntacl: expect canonical ACE flag formatDouglas Bagnall2023-04-281-4/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* py:provision: use canonical representation of ACE flagsDouglas Bagnall2023-04-281-27/+0
| | | | | | | | This is because in ceetain places we compare strings rather than security descriptors. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:ntacls: adapt for canonical flag formatDouglas Bagnall2023-04-281-2/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3:test_larg_acl: adapt for the canonical ACE flags formatDouglas Bagnall2023-04-281-2/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* test:bb/samba-tool ntacl: let return acl flag lack hex paddingDouglas Bagnall2023-04-281-4/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: do not pad sddl flags with zerosDouglas Bagnall2023-04-281-0/+117
| | | | | | | We don't see this happening on Windows. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/sec/sddl decode: allow hex numbers in SIDsDouglas Bagnall2023-04-281-12/+0
| | | | | | | | | | | | | | | | | | | | | These occur canonically when the indentifier authority is > 2^32, but also are accepted by Windows for any number. There is a tricky case with an "O:" or "G:" SID that is immediately followed by a "D:" dacl, because the "D" looks like a hex digit. When we detect this we need to subtract one from the length. We also need to do look out for trailing garbage. This was not an issue before because any string caught by the strspn(..., "-0123456789") would be either rejected or fully comsumed by dom_sid_parse_talloc(), but with hex digits, a string like "S-1-1-2x0xabcxxx-X" would be successfully parsed as "S-1-1-2", and the "x0xabcxxx-X" would be skipped over. That's why we switch to using dom_sid_parse_endp(), so we can compare the consumed length to the expected length. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/sec/sddl decode: don't ignore random junk.Douglas Bagnall2023-04-281-0/+0
| | | | | | | | previously a string could have anything in it, so long as every second character was ':'. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security/dom_sid: hex but not octal is OK for sub-authDouglas Bagnall2023-04-281-2/+4
| | | | | | | | Following Windows, the numbers that would be octal (e.g. "0123") are converted to decimal by skipping over the zeros. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: avoid overflow in subauthsDouglas Bagnall2023-04-281-0/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: avoid overflow in revision numberDouglas Bagnall2023-04-281-4/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sid_strings: test SID DNs with ldb parsingDouglas Bagnall2023-04-281-0/+8
| | | | | | | | | By using an ldb.Dn as an intermediary, we get to see which SIDs Samba thinks are OK but Windows thinks are bad. It is things like "S-0-5-32-579". Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sid_strings: test SIDs as search baseDouglas Bagnall2023-04-281-0/+7
| | | | | | | | | | | | | | | | | | As a way of testing the interpretation of a SID string in a remote server, we search on the base DN "<SID=x>" where x is a non-existent or malformed SID. On Windows some or all malformed SIDs are detected before the search begins, resulting in a complaint about DN syntax rather than one about missing objects. From this we can get a picture of what Windows considers to be a proper SID in this context. Samba does not make a distinction here, always returning NO_SUCH_OBJECT. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sid_strings: Windows and Samba divergent testsDouglas Bagnall2023-04-281-0/+45
| | | | | | | | | The Samba side is aspirational -- what we actually do is generally worse. However the Windows behaviour in these cases seems more surprising still, and seems to be neither documented nor used. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sid_strings: test the strings with local parsingDouglas Bagnall2023-04-281-0/+12
| | | | | | | | | | | | | | | | | | | The reason the existing tests send the SID over the wire as SDDL for defaultSecurityDescriptor is it is one of the few ways to force the server to reckon with a SID-string as a SID. At least, that's the case with Windows. In Samba we make no effort to decode the SDDL until it comes to the time of creating an object, at which point we don't notice the difference between bad SDDL and missing SDDL. So here we add a set of dynamic tests that push the strings through our SDDL parsing code. This doesn't tell us very much more, but it is very quick and sort of confirms that the other tests are on the right track. To run against Windows without also running the internal Samba tests, add `SAMBA_SID_STRINGS_SKIP_LOCAL=1` to your environment variables. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sid_strings: add explicit S-1-* sid testsDouglas Bagnall2023-04-281-0/+16
| | | | | | | | | | | | | | | We are mostly testing edge cases around the handling of numeric limits. These tests are based on ground truth established by running them against Windows. Many fail against Samba, because the defaulSecurityDescriptor attribute is not validated at the time it is set while on Windows it is. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:sid_strings: same timestamp for all tests in the runDouglas Bagnall2023-04-281-3/+3
| | | | | | | | | We don't care about the exact time of the test, just that we disambiguate between different runs (each run leaves an immutable scar on the target server). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* selftest:knownfail: Update S4U knownfail for MIT KRB5 1.20Andreas Schneider2023-04-272-8/+15
| | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3:lib: Do not try to match '.' and '..' directories in is_in_path()Andreas Schneider2023-04-191-1/+0
| | | | | | | | | | | | | This fixes setting veto files to '.*' to not list hidden files and directories starting with a dot. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15360 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Apr 19 22:30:19 UTC 2023 on atb-devel-224
* s3:tests: Add test that veto files works for hidden filesAndreas Schneider2023-04-192-0/+5
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15360 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* shadow_copy2: Fix stream open for streams_depot pathsVolker Lendecke2023-04-171-1/+0
| | | | | | | | | | | | | streams_depot hands us absolute paths with : filename components instead of having set smb_fname_in->stream_name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15358 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Apr 17 18:11:07 UTC 2023 on atb-devel-224
View Lorry Controller Status