summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests
Commit message (Collapse)AuthorAgeFilesLines
* s4-dsdb:large_ldap: Remove unused variablesJoseph Sutton2023-05-161-11/+3
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-dsdb:large_ldap: Remove unused importsJoseph Sutton2023-05-161-6/+1
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/password_lockout: Remove unused variablesJoseph Sutton2023-05-161-15/+12
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/password_lockout: Use correct variableJoseph Sutton2023-05-161-1/+1
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/password_lockout: Use more specific assertion methodsJoseph Sutton2023-05-162-41/+41
| | | | | | | These methods produce better error messages if an assertion fails. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/password_lockout: Remove unused importsJoseph Sutton2023-05-162-9/+2
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb:tests: Refactor security descriptor testJoseph Sutton2023-05-161-2/+2
| | | | | | | Use more specific unittest methods. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb:tests: Refactor confidential attributes testJoseph Sutton2023-05-161-53/+16
| | | | | | | Use more specific unittest methods, and remove unused code. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb:tests: Refactor ACL testJoseph Sutton2023-05-161-34/+30
| | | | | | | Use more specific unittest methods; remove some unused variables. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/dsdb: fix unnecessary backslashRob van der Linde2023-05-052-6/+6
| | | | | | Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/tests: fix assignment to for loop variableRob van der Linde2023-05-051-5/+5
| | | | | | | | because the loop variables are all called 'k' and the inner and outer loop both use 'k'. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest:large_ldap: use a valid ACEDouglas Bagnall2023-04-281-1/+1
| | | | | | | Real ACEs don't have {} around their GUIDs. This will soon be banned. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pytest/acl: Remove unused remnants of source4/dsdb/tests/python/acl.pyJoseph Sutton2023-04-121-58/+1
| | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4-dsdb:large_ldap: Note that we don't check that an error was raisedJoseph Sutton2023-04-121-0/+16
| | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4-dsdb:large_ldap: Assert that we got all the entriesJoseph Sutton2023-04-121-0/+2
| | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4-dsdb:large_ldap: Fix disabled testJoseph Sutton2023-04-121-3/+3
| | | | | | This test was silently skipped due to setUpClass() throwing a NameError. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4-dsdb:large_ldap: Correctly increment count variableJoseph Sutton2023-04-121-1/+1
| | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4-dsdb:large_ldap: Fix typos in variable namesJoseph Sutton2023-04-121-2/+2
| | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* dsdb/tests: Add test for modification of unicodePwd over a cleartext/signed ↵Rob van der Linde2023-04-061-0/+151
| | | | | | | | | | connection This demonstrates that the server did not detect CVE-2023-0922 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* dsdb/tests: Double number of expressions in large_ldap.py ldap_timeout testAndrew Bartlett2023-04-061-1/+1
| | | | | | | | | | | | | | By slowing the filter down more this makes the test reliable on the autobuild host. This is not a long-term solution, but is a quick tweak that can be done today to address current issues with getting commits past the host-based (compared with cloud-based) autobuild. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15351 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* dsdb/tests: Move SD modification on class-created objects to classSetUpAndrew Bartlett2023-04-061-10/+8
| | | | | | | | | | These modifications persist, so should be done at the class level, not in the test. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15351 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* CVE-2023-0225 pytest/acl: test deleting dNSHostName as unprivileged userDouglas Bagnall2023-04-051-0/+236
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15276 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: Remove remaining references to DC_MODE_RETURN_NONE and DC_MODE_RETURN_ALLAndrew Bartlett2023-04-051-70/+16
| | | | | | | | | | The confidential_attrs test no longer uses DC_MODE_RETURN_NONE we can now remove the complexity. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* CVE-2023-0614 ldb: Prevent disclosure of confidential attributesJoseph Sutton2023-04-051-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a hook, acl_redact_msg_for_filter(), in the aclread module, that marks inaccessible any message elements used by an LDAP search filter that the user has no right to access. Make the various ldb_match_*() functions check whether message elements are accessible, and refuse to match any that are not. Remaining message elements, not mentioned in the search filter, are checked in aclread_callback(), and any inaccessible elements are removed at this point. Certain attributes, namely objectClass, distinguishedName, name, and objectGUID, are always present, and hence the presence of said attributes is always allowed to be checked in a search filter. This corresponds with the behaviour of Windows. Further, we unconditionally allow the attributes isDeleted and isRecycled in a check for presence or equality. Windows is not known to make this special exception, but it seems mostly harmless, and should mitigate the performance impact on searches made by the show_deleted module. As a result of all these changes, our behaviour regarding confidential attributes happens to match Windows more closely. For the test in confidential_attr.py, we can now model our attribute handling with DC_MODE_RETURN_ALL, which corresponds to the behaviour exhibited by Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2023-0614 tests/krb5: Add test for confidential attributes timing ↵Joseph Sutton2023-04-051-0/+162
| | | | | | | | differences BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2023-0614 s4:dsdb:tests: Fix <GUID={}> search in confidential attributes ↵Joseph Sutton2023-04-051-3/+3
| | | | | | | | | | | | | | | | | | | | test The object returned by schema_format_value() is a bytes object. Therefore the search expression would resemble: (lastKnownParent=<GUID=b'00000000-0000-0000-0000-000000000000'>) which, due to the extra characters, would fail to match anything. Fix it to be: (lastKnownParent=<GUID=00000000-0000-0000-0000-000000000000>) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2023-0614 dsdb: Alter timeout test in large_ldap.py to be slower by ↵Andrew Bartlett2023-04-051-2/+15
| | | | | | | | | | | matching on large objects This changes the slow aspect to be the object matching not the filter parsing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* s4-dsdb: Account for Claims Valid SID in tokenGroupsJoseph Sutton2023-03-311-2/+6
| | | | | | | | More of these tests now pass against Windows. They still don't quite all pass, but that's something to fix for another day. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: let a test to demonstrate the behavior of invisible backlinksStefan Metzmacher2023-03-231-0/+100
| | | | | | | | | | | | | | | | | | | | msDS-KeyCredentialLink/msDS-KeyCredentialLink-BL are defined as linked attribute pair, but msDS-KeyCredentialLink-BL is not defined as allowed on any object class definition, still it's possible to create msDS-KeyCredentialLink attributes. msDS-KeyPrincipal/msDS-KeyPrincipalBL are also defined as linked attribute pair and msDS-KeyPrincipalBL is only allowed on object class 'user', but it's possible to create msDS-KeyPrincipal values pointing to non 'user' objects. The result is that 'user' objects have a visible msDS-KeyPrincipalBL, but the others don't have msDS-KeyPrincipalBL visible, by default. The backlinks are always visible if the backlink attributes are explicitly requested. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12967 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: let linked_attributes.py use a container as testbaseStefan Metzmacher2023-03-231-7/+7
| | | | | | | | | | | The tests don't require an organizationalUnit as parent object and it makes it possible to create msDS-KeyCredential objects within the container in the next step. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12967 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: use changetype: modify in order to delete a single attributeStefan Metzmacher2023-03-221-1/+1
| | | | | | | 'changetype: delete' is used to delete a whole object! Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: add more detailed tests to sec_descriptor.pyStefan Metzmacher2023-03-221-0/+501
| | | | | | | | | | These demonstrate how inherited aces are constructed and applies per objectclass, with and without the NO_PROPAGATE_INHERIT flag. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: allow sec_descriptor.py to run against Windows 2022Stefan Metzmacher2023-03-221-4/+4
| | | | | | | | | We need SEC_STD_DELETE in order to run the test twice against the same server. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: convert sec_descriptor.py to use assert[Not]In()Stefan Metzmacher2023-03-221-149/+149
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: let AclUndeleteTests.test_undelete() remove the temporary ACE ↵Stefan Metzmacher2023-03-221-0/+1
| | | | | | | | | | | again Otherwise we impact other unrelated tests, e.g. 'blackbox.dbcheck'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: let OwnerGroupDescriptorTests() remove temporary ACEs on cleanupStefan Metzmacher2023-03-221-0/+2
| | | | | | | | | Otherwise we impact other unrelated tests, e.g. 'blackbox.dbcheck'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/tests: let OwnerGroupDescriptorTests.test_141() set the required ACE ↵Stefan Metzmacher2023-03-221-0/+3
| | | | | | | | | | | | | | | | explicitly All other tests use the same logic and run before, which means the ACE is already there and is implicitly required. As we want to cleanup the ACE after each test in the next step, as the tests should not have side effects for other tests, e.g. 'blackbox.dbcheck'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: Reorder SDDL access flags table to match WindowsJoseph Sutton2023-03-211-6/+6
| | | | | | | | | | | | This means that encoding an ACE in string form will now match Windows. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Mar 21 01:19:16 UTC 2023 on atb-devel-224
* selftest: Use setUpClass() to reduce "make test TESTS=large_ldap" timeAndrew Bartlett2023-03-141-33/+36
| | | | | | | | | | | | This reduces the elapsed time to 6m from 20m on my laptop. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15332 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Mar 14 07:16:04 UTC 2023 on atb-devel-224
* s4-dsdb:tests: Correctly handle LdbErrorJoseph Sutton2023-03-081-1/+1
| | | | | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Mar 8 05:37:08 UTC 2023 on atb-devel-224
* s4-dsdb:tests: Fix AD DC performance testsJoseph Sutton2023-03-083-21/+21
| | | | | | | | | | | Calling cmd._run() directly would fail due to the 'command_name' attribute being absent, so these tests would fail to run. Fix this by using the samba.netcmd.main.samba_tool helper function. Check the return code as well for good measure. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* selftest: source4: fix mutable default argumentsRob van der Linde2023-02-236-8/+30
| | | | | | Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* selftest: fix typo in test commentRob van der Linde2023-02-231-1/+1
| | | | | | Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* selftest: fix scope and attrs not passed to searchRob van der Linde2023-02-231-2/+2
| | | | | | Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* s4-dsdb: Use correct primary group SID in token group testJoseph Sutton2023-02-081-1/+1
| | | | | | | | This test will thereby continue to pass when we correct the handling of primary groups. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Shorten long SID flags combinationsJoseph Sutton2023-02-081-1/+1
| | | | | | | | | The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very commonly used, and introducing a shorter alias for it makes the code clearer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python: Replace calls to deprecated methodsJoseph Sutton2023-01-301-10/+10
| | | | | | | These aliases are deprecated and have been removed in Python 3.12. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-dsdb: Remove unused variables in token_group python testJoseph Sutton2022-10-211-2/+0
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s4-dsdb: simplify conditional in python token_group testJoseph Sutton2022-10-211-2/+2
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s4-dsdb: Remove unused import in token_group python testJoseph Sutton2022-10-211-1/+1
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
View Lorry Controller Status