Gecko [ tsuru-no-tsurugi.tokyo ]

Name	Size	Permission	Date
__pycache__	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
blackbox	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
dcerpc	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
dns_forwarder_helpers	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
emulate	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
kcc	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
krb5	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
samba_tool	[ DIR ]	drwxr-xr-x	2026-05-28 07:00
__init__.py	22.9 KB	-rw-r--r--	2022-04-26 23:34
audit_log_base.py	6.98 KB	-rw-r--r--	2021-08-09 22:38
audit_log_dsdb.py	24.46 KB	-rw-r--r--	2021-08-09 22:38
audit_log_pass_change.py	12.86 KB	-rw-r--r--	2021-08-09 22:38
auth.py	4.5 KB	-rw-r--r--	2021-08-09 22:38
auth_log.py	65.62 KB	-rw-r--r--	2026-05-22 02:08
auth_log_base.py	5.42 KB	-rw-r--r--	2021-08-09 22:38
auth_log_ncalrpc.py	4.19 KB	-rw-r--r--	2021-08-09 22:38
auth_log_netlogon.py	5.22 KB	-rw-r--r--	2021-08-09 22:38
auth_log_netlogon_bad_creds.py	7.7 KB	-rw-r--r--	2021-08-09 22:38
auth_log_pass_change.py	12.92 KB	-rw-r--r--	2021-08-09 22:38
auth_log_samlogon.py	6.68 KB	-rw-r--r--	2021-08-09 22:38
auth_log_winbind.py	19.13 KB	-rw-r--r--	2021-08-09 22:38
common.py	3.06 KB	-rw-r--r--	2021-08-09 22:38
complex_expressions.py	18.37 KB	-rw-r--r--	2021-08-09 22:38
core.py	2.77 KB	-rw-r--r--	2021-08-09 22:38
cred_opt.py	1.73 KB	-rw-r--r--	2021-08-09 22:38
credentials.py	22.13 KB	-rw-r--r--	2021-08-09 22:38
dckeytab.py	2.11 KB	-rw-r--r--	2021-08-09 22:38
dns.py	84.34 KB	-rw-r--r--	2021-08-09 22:38
dns_aging.py	108.76 KB	-rw-r--r--	2021-08-09 22:38
dns_base.py	14.3 KB	-rw-r--r--	2021-08-09 22:38
dns_forwarder.py	20.95 KB	-rw-r--r--	2021-08-09 22:38
dns_invalid.py	2.66 KB	-rw-r--r--	2021-08-09 22:38
dns_packet.py	7.13 KB	-rw-r--r--	2021-08-09 22:38
dns_tkey.py	7.11 KB	-rw-r--r--	2021-08-09 22:38
dns_wildcard.py	12.89 KB	-rw-r--r--	2021-08-09 22:38
docs.py	18.25 KB	-rw-r--r--	2021-08-09 22:38
domain_backup.py	26.76 KB	-rw-r--r--	2021-08-09 22:38
domain_backup_offline.py	10.01 KB	-rw-r--r--	2021-08-09 22:38
dsdb.py	41.91 KB	-rw-r--r--	2021-08-09 22:38
dsdb_api.py	1.93 KB	-rw-r--r--	2021-11-08 20:23
dsdb_dns.py	2.56 KB	-rw-r--r--	2021-08-09 22:38
dsdb_lock.py	11.63 KB	-rw-r--r--	2021-08-09 22:38
dsdb_schema_attributes.py	8.9 KB	-rw-r--r--	2021-09-09 15:30
encrypted_secrets.py	3.02 KB	-rw-r--r--	2021-08-09 22:38
gensec.py	8.91 KB	-rw-r--r--	2021-08-09 22:38
get_opt.py	2.47 KB	-rw-r--r--	2021-08-09 22:38
getdcname.py	18.52 KB	-rw-r--r--	2021-08-09 22:38
glue.py	3.75 KB	-rw-r--r--	2021-08-09 22:38
gpo.py	80.28 KB	-rw-r--r--	2021-08-09 22:38
gpo_member.py	1.69 KB	-rw-r--r--	2021-08-09 22:38
graph.py	26.45 KB	-rw-r--r--	2021-08-09 22:38
group_audit.py	16.52 KB	-rw-r--r--	2021-08-09 22:38
hostconfig.py	2.14 KB	-rw-r--r--	2021-08-09 22:38
imports.py	1.12 KB	-rw-r--r--	2021-08-09 22:38
join.py	6.71 KB	-rw-r--r--	2021-08-09 22:38
krb5_credentials.py	3.8 KB	-rw-r--r--	2021-08-09 22:38
ldap_raw.py	31.92 KB	-rw-r--r--	2021-08-09 22:38
ldap_referrals.py	3.13 KB	-rw-r--r--	2021-08-09 22:38
ldap_spn.py	34.19 KB	-rw-r--r--	2022-01-31 20:23
ldap_upn_sam_account.py	17.63 KB	-rw-r--r--	2021-11-08 20:23
libsmb.py	4.26 KB	-rw-r--r--	2021-08-09 22:38
loadparm.py	3.25 KB	-rw-r--r--	2021-08-09 22:38
lsa_string.py	2.22 KB	-rw-r--r--	2021-08-09 22:38
messaging.py	4.97 KB	-rw-r--r--	2021-08-09 22:38
ndr.py	4.09 KB	-rw-r--r--	2021-08-09 22:38
net_join.py	2.29 KB	-rw-r--r--	2021-08-09 22:38
net_join_no_spnego.py	3.46 KB	-rw-r--r--	2021-08-09 22:38
netbios.py	2.08 KB	-rw-r--r--	2021-08-09 22:38
netcmd.py	5.32 KB	-rw-r--r--	2021-08-09 22:38
netlogonsvc.py	2.43 KB	-rw-r--r--	2021-08-09 22:38
ntacls.py	3.68 KB	-rw-r--r--	2021-08-09 22:38
ntacls_backup.py	6.58 KB	-rw-r--r--	2021-08-09 22:38
ntlm_auth.py	13.08 KB	-rw-r--r--	2021-08-09 22:38
ntlm_auth_base.py	8.5 KB	-rw-r--r--	2021-08-09 22:38
ntlm_auth_krb5.py	3.63 KB	-rw-r--r--	2021-08-09 22:38
ntlmdisabled.py	3.01 KB	-rw-r--r--	2021-08-09 22:38
pam_winbind.py	2.52 KB	-rw-r--r--	2021-08-09 22:38
pam_winbind_chauthtok.py	1.56 KB	-rw-r--r--	2021-08-09 22:38
pam_winbind_warn_pwd_expire.py	2.01 KB	-rw-r--r--	2021-08-09 22:38
param.py	3.58 KB	-rw-r--r--	2021-08-09 22:38
password_hash.py	12.43 KB	-rw-r--r--	2021-08-09 22:38
password_hash_fl2003.py	7.34 KB	-rw-r--r--	2021-08-09 22:38
password_hash_fl2008.py	7.89 KB	-rw-r--r--	2021-08-09 22:38
password_hash_gpgme.py	11.88 KB	-rw-r--r--	2021-08-09 22:38
password_hash_ldap.py	4.85 KB	-rw-r--r--	2021-08-09 22:38
password_quality.py	2.15 KB	-rw-r--r--	2021-08-09 22:38
password_test.py	1.94 KB	-rw-r--r--	2021-08-09 22:38
policy.py	1.17 KB	-rw-r--r--	2021-08-09 22:38
posixacl.py	38.89 KB	-rw-r--r--	2021-08-09 22:38
prefork_restart.py	16 KB	-rw-r--r--	2021-08-09 22:38
process_limits.py	2.95 KB	-rw-r--r--	2021-08-09 22:38
provision.py	6.35 KB	-rw-r--r--	2021-08-09 22:38
pso.py	11.23 KB	-rw-r--r--	2021-08-09 22:38
py_credentials.py	14.82 KB	-rw-r--r--	2021-08-09 22:38
registry.py	2.5 KB	-rw-r--r--	2021-08-09 22:38
s3_net_join.py	2.63 KB	-rw-r--r--	2021-10-27 21:53
s3idmapdb.py	1.95 KB	-rw-r--r--	2021-08-09 22:38
s3param.py	1.75 KB	-rw-r--r--	2021-08-09 22:38
s3passdb.py	5.66 KB	-rw-r--r--	2021-08-09 22:38
s3registry.py	1.82 KB	-rw-r--r--	2021-08-09 22:38
s3windb.py	1.48 KB	-rw-r--r--	2021-08-09 22:38
samba3sam.py	48.45 KB	-rw-r--r--	2021-08-09 22:38
samba_upgradedns_lmdb.py	2.56 KB	-rw-r--r--	2021-08-09 22:38
samdb.py	2.51 KB	-rw-r--r--	2021-08-09 22:38
samdb_api.py	5.41 KB	-rw-r--r--	2021-08-09 22:38
sddl.py	8.86 KB	-rw-r--r--	2021-08-09 22:38
security.py	6.25 KB	-rw-r--r--	2021-08-09 22:38
segfault.py	7 KB	-rw-r--r--	2021-10-27 21:53
smb-notify.py	18.85 KB	-rw-r--r--	2021-08-09 22:38
smb.py	9.47 KB	-rw-r--r--	2021-08-09 22:38
smbd_base.py	1.76 KB	-rw-r--r--	2021-08-09 22:38
smbd_fuzztest.py	3.5 KB	-rw-r--r--	2021-08-09 22:38
source.py	8.74 KB	-rw-r--r--	2021-08-09 22:38
strings.py	3.89 KB	-rw-r--r--	2021-08-09 22:38
subunitrun.py	2.33 KB	-rw-r--r--	2021-08-09 22:38
tdb_util.py	1.76 KB	-rw-r--r--	2021-08-09 22:38
upgrade.py	1.36 KB	-rw-r--r--	2021-08-09 22:38
upgradeprovision.py	6.65 KB	-rw-r--r--	2021-08-09 22:38
upgradeprovisionneeddc.py	7.49 KB	-rw-r--r--	2021-08-09 22:38
usage.py	12.98 KB	-rw-r--r--	2026-05-22 02:08
xattr.py	5.27 KB	-rw-r--r--	2021-08-09 22:38

Rename

# Tests for Tests for source4/dsdb/samdb/ldb_modules/password_hash.c
#
# Copyright (C) Catalyst IT Ltd. 2017
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

"""
Tests for source4/dsdb/samdb/ldb_modules/password_hash.c
These tests need to be run in an environment in which
io->ac->gpg_key_ids != NULL, so that the gpg supplemental credentials
are generated. The functional level needs to be >= 2008 so that the
kerberos newer keys are generated.
"""

from samba.tests.password_hash import (
    PassWordHashTests,
    get_package,
    USER_PASS,
    USER_NAME
)
from samba.ndr import ndr_unpack
from samba.dcerpc import drsblobs
import binascii
from samba.tests.pso import PasswordSettings
import samba

class PassWordHashGpgmeTests(PassWordHashTests):

def setUp(self):
        super(PassWordHashGpgmeTests, self).setUp()

def test_default_supplementalCredentials(self):
        self.add_user()
        if not self.lp.get("password hash gpg key ids"):
            self.skipTest("No password hash gpg key ids, " +
                          "Primary:SambaGPG will not be generated")

sc = self.get_supplemental_creds()

# Check that we got all the expected supplemental credentials
        # And they are in the expected order.
        size = len(sc.sub.packages)
        self.assertEqual(5, size)
        (pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
        self.assertEqual(1, pos)
        self.assertEqual("Primary:Kerberos-Newer-Keys", package.name)

(pos, package) = get_package(sc, "Primary:Kerberos")
        self.assertEqual(2, pos)
        self.assertEqual("Primary:Kerberos", package.name)

(pos, wd_package) = get_package(sc, "Primary:WDigest")
        self.assertEqual(3, pos)
        self.assertEqual("Primary:WDigest", wd_package.name)

(pos, package) = get_package(sc, "Packages")
        self.assertEqual(4, pos)
        self.assertEqual("Packages", package.name)

(pos, package) = get_package(sc, "Primary:SambaGPG")
        self.assertEqual(5, pos)
        self.assertEqual("Primary:SambaGPG", package.name)

# Check that the WDigest values are correct.
        #
        digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
                             binascii.a2b_hex(wd_package.data))
        self.check_wdigests(digests)

def test_supplementalCredentials_cleartext(self):
        self.add_user(clear_text=True)
        if not self.lp.get("password hash gpg key ids"):
            self.skipTest("No password hash gpg key ids, " +
                          "Primary:SambaGPG will not be generated")

sc = self.get_supplemental_creds()

# Check that we got all the expected supplemental credentials
        # And they are in the expected order.
        size = len(sc.sub.packages)
        self.assertEqual(6, size)
        (pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
        self.assertEqual(1, pos)
        self.assertEqual("Primary:Kerberos-Newer-Keys", package.name)

(pos, package) = get_package(sc, "Primary:Kerberos")
        self.assertEqual(2, pos)
        self.assertEqual("Primary:Kerberos", package.name)

(pos, wd_package) = get_package(sc, "Primary:WDigest")
        self.assertEqual(3, pos)
        self.assertEqual("Primary:WDigest", wd_package.name)

(pos, ct_package) = get_package(sc, "Primary:CLEARTEXT")
        self.assertEqual(4, pos)
        self.assertEqual("Primary:CLEARTEXT", ct_package.name)

(pos, package) = get_package(sc, "Packages")
        self.assertEqual(5, pos)
        self.assertEqual("Packages", package.name)

(pos, package) = get_package(sc, "Primary:SambaGPG")
        self.assertEqual(6, pos)
        self.assertEqual("Primary:SambaGPG", package.name)

# Check the clear text  value is correct.
        ct = ndr_unpack(drsblobs.package_PrimaryCLEARTEXTBlob,
                        binascii.a2b_hex(ct_package.data))
        self.assertEqual(USER_PASS.encode('utf-16-le'), ct.cleartext)

def assert_cleartext(self, expect_cleartext, password=None):
        """Checks cleartext is (or isn't) returned as expected"""
        sc = self.get_supplemental_creds()
        if expect_cleartext:
            (pos, ct_package) = get_package(sc, "Primary:CLEARTEXT")
            self.assertTrue(ct_package is not None, "Failed to retrieve cleartext")

# Check the clear-text value is correct.
            ct = ndr_unpack(drsblobs.package_PrimaryCLEARTEXTBlob,
                            binascii.a2b_hex(ct_package.data))
            self.assertEqual(password.encode('utf-16-le'), ct.cleartext)
        else:
            ct_package = get_package(sc, "Primary:CLEARTEXT")
            self.assertTrue(ct_package is None,
                            "Got cleartext when we shouldn't have")

def test_supplementalCredentials_cleartext_pso(self):
        """Checks that a PSO's cleartext setting can override the domain's"""

# create a user that stores plain-text passwords
        self.add_user(clear_text=True)

# check that clear-text is present in the supplementary-credentials
        self.assert_cleartext(expect_cleartext=True, password=USER_PASS)

# create a PSO overriding the plain-text setting & apply it to the user
        no_plaintext_pso = PasswordSettings("no-plaintext-PSO", self.ldb,
                                            precedence=200,
                                            store_plaintext=False)
        self.addCleanup(self.ldb.delete, no_plaintext_pso.dn)
        userdn = "cn=" + USER_NAME + ",cn=users," + self.base_dn
        no_plaintext_pso.apply_to(userdn)

# set the password to update the cleartext password stored
        new_password = samba.generate_random_password(32, 32)
        self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)

# this time cleartext shouldn't be in the supplementary creds
        self.assert_cleartext(expect_cleartext=False)

# unapply PSO, update password, and check we get the cleartext again
        no_plaintext_pso.unapply(userdn)
        new_password = samba.generate_random_password(32, 32)
        self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
        self.assert_cleartext(expect_cleartext=True, password=new_password)

# Now update the domain setting and check we no longer get cleartext
        self.set_store_cleartext(False)
        new_password = samba.generate_random_password(32, 32)
        self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
        self.assert_cleartext(expect_cleartext=False)

# create a PSO overriding the domain setting & apply it to the user
        plaintext_pso = PasswordSettings("plaintext-PSO", self.ldb,
                                         precedence=100, store_plaintext=True)
        self.addCleanup(self.ldb.delete, plaintext_pso.dn)
        plaintext_pso.apply_to(userdn)
        new_password = samba.generate_random_password(32, 32)
        self.ldb.setpassword("(sAMAccountName=%s)" % USER_NAME, new_password)
        self.assert_cleartext(expect_cleartext=True, password=new_password)

def test_userPassword_multiple_hashes(self):
        self.add_user(options=[(
            "password hash userPassword schemes",
            "CryptSHA512 CryptSHA256 CryptSHA512")])

sc = self.get_supplemental_creds()

# Check that we got all the expected supplemental credentials
        # And they are in the expected order.
        size = len(sc.sub.packages)
        self.assertEqual(6, size)

(pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
        self.assertEqual(1, pos)
        self.assertEqual("Primary:Kerberos-Newer-Keys", package.name)

(pos, package) = get_package(sc, "Primary:Kerberos")
        self.assertEqual(2, pos)
        self.assertEqual("Primary:Kerberos", package.name)

(pos, wp_package) = get_package(sc, "Primary:WDigest")
        self.assertEqual(3, pos)
        self.assertEqual("Primary:WDigest", wp_package.name)

(pos, up_package) = get_package(sc, "Primary:userPassword")
        self.assertEqual(4, pos)
        self.assertEqual("Primary:userPassword", up_package.name)

(pos, package) = get_package(sc, "Packages")
        self.assertEqual(5, pos)
        self.assertEqual("Packages", package.name)

(pos, package) = get_package(sc, "Primary:SambaGPG")
        self.assertEqual(6, pos)
        self.assertEqual("Primary:SambaGPG", package.name)

# Check that the WDigest values are correct.
        #
        digests = ndr_unpack(drsblobs.package_PrimaryWDigestBlob,
                             binascii.a2b_hex(wp_package.data))
        self.check_wdigests(digests)

# Check that the userPassword hashes are computed correctly
        # Expect three hashes to be calculated
        up = ndr_unpack(drsblobs.package_PrimaryUserPasswordBlob,
                        binascii.a2b_hex(up_package.data))
        self.checkUserPassword(up, [
            ("{CRYPT}", "6", None),
            ("{CRYPT}", "5", None),
            ("{CRYPT}", "6", None)
        ])
        self.checkNtHash(USER_PASS, up.current_nt_hash.hash)

def test_userPassword_multiple_hashes_rounds_specified(self):
        self.add_user(options=[(
            "password hash userPassword schemes",
            "CryptSHA512:rounds=5120 CryptSHA256:rounds=2560 CryptSHA512:rounds=5122")])

sc = self.get_supplemental_creds()

# Check that we got all the expected supplemental credentials
        # And they are in the expected order.
        size = len(sc.sub.packages)
        self.assertEqual(6, size)

(pos, package) = get_package(sc, "Primary:Kerberos-Newer-Keys")
        self.assertEqual(1, pos)
        self.assertEqual("Primary:Kerberos-Newer-Keys", package.name)

(pos, package) = get_package(sc, "Primary:Kerberos")
        self.assertEqual(2, pos)
        self.assertEqual("Primary:Kerberos", package.name)

(pos, wp_package) = get_package(sc, "Primary:WDigest")
        self.assertEqual(3, pos)
        self.assertEqual("Primary:WDigest", wp_package.name)

(pos, up_package) = get_package(sc, "Primary:userPassword")
        self.assertEqual(4, pos)
        self.assertEqual("Primary:userPassword", up_package.name)

(pos, package) = get_package(sc, "Packages")
        self.assertEqual(5, pos)
        self.assertEqual("Packages", package.name)

(pos, package) = get_package(sc, "Primary:SambaGPG")
        self.assertEqual(6, pos)
        self.assertEqual("Primary:SambaGPG", package.name)

# Check that the userPassword hashes are computed correctly
        # Expect three hashes to be calculated
        up = ndr_unpack(drsblobs.package_PrimaryUserPasswordBlob,
                        binascii.a2b_hex(up_package.data))
        self.checkUserPassword(up, [
            ("{CRYPT}", "6", 5120),
            ("{CRYPT}", "5", 2560),
            ("{CRYPT}", "6", 5122)
        ])
        self.checkNtHash(USER_PASS, up.current_nt_hash.hash)