a
    W×aÊŠ  ã                   @   s   d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ G d	d
„ d
eƒZdS )é    N)ÚSambaToolCmdTest)ÚcredentialsÚnttime2unixÚdsdb)Ú
ndr_unpack)Údrsblobs)Ú	get_bytes)Ú
get_string)Úenv_loadparmc                       sâ   e Zd ZdZg ZdZ‡ fdd„Z‡ fdd„Zdd„ Zd1dd„Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zi fdd„Zi fdd „Zi fd!d"„Zd#d$„ Zd%d&„ Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Z‡  ZS )2ÚUserCmdTestCasez%Tests for samba-tool user subcommandsNc                    sÖ  t t| ƒ ¡  |  ddtjd  dtjd tjd f ¡| _g | _| j |  	ddd	œ¡¡ | j |  	d
dd	œ¡¡ | j |  	ddd	œ¡¡ | j |  	ddd	œ¡¡ | j |  
ddi¡¡ | j |  
ddi¡¡ | j |  
ddi¡¡ | j |  
ddi¡¡ | j |  ddi¡¡ | j |  ddi¡¡ | j |  ddi¡¡ | j |  ddi¡¡ | jD ]x}|d |ƒ\}}}|  |||¡ |  |dd¡ d|d v r®|  d|d  |¡ n|  d|d  |¡ |d |ƒ qXd S )Nú-Hú	ldap://%sÚ	DC_SERVERú-U%s%%%sÚDC_USERNAMEÚDC_PASSWORDZ
sambatool1Zcomp1)ÚnameÚcompanyZ
sambatool2Z
sambatool3Úcomp2Z
sambatool4r   Z
posixuser1Z
posixuser2Z
posixuser3Z
posixuser4Z	unixuser1Z	unixuser2Z	unixuser3Z	unixuser4ÚcreateUserFnÚ úShouldn't be any error messagesZunixzModified User '%s' successfullyúUser '%s' created successfullyÚcheckUserFn)Úsuperr   ÚsetUpZgetSamDBÚosÚenvironÚsamdbÚusersÚappendÚ_randomUserÚ_randomPosixUserÚ_randomUnixUserÚassertCmdSuccessÚassertEqualÚassertIn)ÚselfÚuserÚresultÚoutÚerr©Ú	__class__© ú=/usr/lib/python3/dist-packages/samba/tests/samba_tool/user.pyr   (   s:    ÿ
ÿÿzUserCmdTestCase.setUpc                    sd   t t| ƒ ¡  | jD ]$}|  |d ¡r|  dd|d ¡ qtƒ }| d¡}tj	 
|¡r`t |¡ d S )Nr   r(   Údeletezuser-syncpasswords-cache.ldb)r   r   ÚtearDownr   Ú
_find_userÚ	runsubcmdr
   Zprivate_pathr   ÚpathÚexistsÚremove)r'   r(   ZlpZcachedbr,   r.   r/   r1   I   s    

zUserCmdTestCase.tearDownc                 C   s‚  | j D ],}|  |¡\}}}|  |d¡ |  d|¡ q| j D ]D}|  dd|d ¡\}}}|  |||d¡ |  |d ¡}|  |¡ q:| j D ]ö}|  dd|d |d d	d
|d  d|d  d|d  d|d  d|d  d|d  ddtj	d  dtj	d tj	d f ¡\}}}|  |||¡ |  
|dd¡ |  d|d  |¡ |  |d ¡}|  
d| d ¡ d!| ¡ |  
d| d¡ d!| ¡ q†d S )"NzEnsure that create user failsz'LDAP error 68 LDAP_ENTRY_ALREADY_EXISTSr(   r0   r   zCan we delete usersÚcreateÚpasswordz--use-username-as-cnú--surname=%sÚsurnameú--given-name=%sú
given-nameú--job-title=%sú	job-titleú--department=%sÚ
departmentú--description=%sÚdescriptionú--company=%sr   r   r   r   r   r   r   r   r   r   ú%sZcnz%(name)s)r   Ú_create_userÚassertCmdFailr&   r3   r$   r2   ZassertIsNoner   r   r%   Úget)r'   r(   r)   r*   r+   Úfoundr.   r.   r/   Útest_newuserW   s6    








÷
zUserCmdTestCase.test_newuseré   é   c                 C   s6  | j  |¡}t|ƒ\}}|  d|d¡ |d d }ttj|ƒ}|  |jj	|d¡ |  
|jj	|d¡ |dkrnd S ddd„}	d}
|	|jjd|
d	\}}|  |d
¡ |  |d |jj	d d¡ |	|jjd|
d	\}}|d urü|  ||
d¡ |
d }
|
|krü|
d }
|	|jjd|
d	\}}|  |d¡ |  ||
d¡ |
d }
|
|krF|
d }
|	|jjd|
d	\}}|  |d¡ |  ||
d¡ |
d }
|
|kr|
d }
|	|jjd|
d	\}}|d urØ|  ||
d¡ |
d }
|
|krØ|
d }
|	|jjd|
d	\}}|d ur |  ||
d¡ |
d }
|
|kr |
d }
|  |
|jj	d¡ d S )NZsupplementalCredentialsz*supplementalCredentials attribute requiredr   zmin_packages checkzmax_packages checkc                 S   s6   t |t| ƒƒD ]"}| | j|kr|| | f  S qdS )N)NN)ÚrangeÚlenr   )Úpackagesr   Ú	start_idxÚir.   r.   r/   Úfind_package   s    zEUserCmdTestCase._verify_supplementalCredentials.<locals>.find_packageZPackages)rO   zPackages requiredé   z(Packages needs to be at num_packages - 1zPrimary:Kerberos-Newer-Keysz-Primary:Kerberos-Newer-Keys at wrong positionzPrimary:KerberoszPrimary:Kerberos requiredz"Primary:Kerberos at wrong positionzPrimary:WDigestzPrimary:WDigest requiredz!Primary:WDigest at wrong positionzPrimary:CLEARTEXTz#Primary:CLEARTEXT at wrong positionzPrimary:SambaGPGz"Primary:SambaGPG at wrong positionzUnknown packages found)r   )r   Z
parse_ldifÚnextr&   r   r   ZsupplementalCredentialsBlobZassertGreaterEqualÚsubZnum_packagesZassertLessEqualrN   ZassertIsNotNoner%   )r'   ZldifZmin_packagesZmax_packagesZmsgsZ
changetypeÚobjZsc_blobZscrQ   ZnidxZpidxZppZknidxZknpZkidxZkpZwidxZwpZcidxZcpZgidxZgpr.   r.   r/   Ú_verify_supplementalCredentials{   sz    
ÿ
ÿ
ÿ
ÿ

ÿ


ÿ


ÿ



ÿ


z/UserCmdTestCase._verify_supplementalCredentialsc                 C   sÐ  | j D ]|}|  d¡}|  dd|d d| ddtjd  d	tjd
 tjd f ¡\}}}|  |||d¡ |  |dd¡ |  |dd¡ qd}|  dddd| d¡\}}}|  |||d¡ |  |dd¡ ddii i i ddii i i dœ}| ¡ D ]4}||  	dd¡}	|  |d||	f d||	|f ¡ qè|  ddd¡\}}}|  |||d¡ |  |dd¡ |  |d d!| ¡ | j D ](}|  |d"|d  d#|d |f ¡ qh| j D ]¨}|  d¡}t
 ¡ }
|
 ¡  |
 |¡ |
 ¡ }t |
 ¡ ¡ d$¡}t t|ƒ¡ d$¡}t t|ƒ d%¡¡ d$¡}|  dd|d d| ¡\}}}|  |||d¡ |  |dd&¡ |  |dd&¡ |  ddd¡\}}}|  |||d¡ |  |dd¡ |  |d d!| ¡ |  |d"|d  d#|d |f ¡ |  |d'd(| ¡ |  |d)| d*| ¡ |  |d+d,| ¡ |  |d-d.| ¡ d/|v rP|  |d0| d1| ¡ |  |d2| d3| ¡ |  |d4d5| ¡ |  dd6|d d| d¡\}}}|  |||d7¡ |  |dd¡ |  |d8d¡ |  |d"|d  d9|d |f ¡ |  |d)| d*| ¡ |  |d-d.| ¡ |  | d:d¡¡ d/|v r˜|  |d0| d1| ¡ |  |d2| d3| ¡ |  |d4d5| ¡ q˜| j D ]€}|  d¡}|  dd|d d| d;ddtjd  d	tjd
 tjd f ¡\}}}|  |||d¡ |  |dd<¡ |  |dd<¡ qJd S )=Né   r(   Zsetpasswordr   z--newpassword=%sr   r   r   r   r   r   zEnsure setpassword runsr   zsetpassword with urlzChanged password OKzxsAMAccountName,unicodePwd,supplementalCredentials,virtualClearTextUTF8,virtualClearTextUTF16,virtualSSHA,virtualSambaGPGZsyncpasswordsz--cache-ldb-initializez--attributes=%sz--decrypt-samba-gpgz0Ensure syncpasswords --cache-ldb-initialize runszgetpassword without urlÚvalueZuserSyncPasswordszdirsync:1:0:0)ZobjectClassZsamdbUrlZdirsyncFilterZdirsyncAttributeZdirsyncControlZpasswordAttributeZdecryptSambaGPGZcurrentTimez%s: %sz4syncpasswords --cache-ldb-initialize: %s: %s out[%s]z	--no-waitz#Ensure syncpasswords --no-wait runszsyncpasswords --no-waitzdirsync_loop(): results 0z=syncpasswords --no-wait: 'dirsync_loop(): results 0': out[%s]zsAMAccountName: %sz5syncpasswords --no-wait: 'sAMAccountName': %s out[%s]Úutf8z	utf-16-lezsetpassword without urlz)# unicodePwd::: REDACTED SECRET ATTRIBUTEz@getpassword '# unicodePwd::: REDACTED SECRET ATTRIBUTE': out[%s]zunicodePwd:: %szgetpassword unicodePwd: out[%s]z6# supplementalCredentials::: REDACTED SECRET ATTRIBUTEzMgetpassword '# supplementalCredentials::: REDACTED SECRET ATTRIBUTE': out[%s]zsupplementalCredentials:: z,getpassword supplementalCredentials: out[%s]zvirtualSambaGPG:: zvirtualClearTextUTF8:: %sz)getpassword virtualClearTextUTF8: out[%s]zvirtualClearTextUTF16:: %sz*getpassword virtualClearTextUTF16: out[%s]zvirtualSSHA: z getpassword virtualSSHA: out[%s]ZgetpasswordzEnsure getpassword runszGot password OKz)getpassword: 'sAMAccountName': %s out[%s]z
Got password OK
z--must-change-at-next-loginzsetpassword with forced change)r   Úrandom_passwordr3   r   r   r$   r%   ÚassertMatchÚkeysrG   r   ZCredentialsZset_anonymousZset_passwordZget_nt_hashÚbase64Z	b64encodeÚdecoder   r	   ÚencoderV   Úreplace)r'   r(   Z	newpasswdr)   r*   r+   Z
attributesZcache_attrsÚaÚvZcredsZnthashZ
unicodePwdZvirtualClearTextUTF8ZvirtualClearTextUTF16r.   r.   r/   Útest_setpasswordÎ   s   

ü
ý
ø
ÿÿ
ÿ

þ
ÿÿÿÿÿÿ
ÿÿÿý
ÿÿÿ
ÿÿÿ

û
z UserCmdTestCase.test_setpasswordc           	      C   s.  | j D ]¦}t ¡ d }|  dd|d dddtjd  d	tjd
 tjd f ¡\}}}|  |||d¡ |  d|d  |¡ |  |d ¡}tt	d| 
d¡ ƒƒ}|  ||dd¡ qd S ]v}|  |d ¡}d| 
d¡ dkr tt	d| 
d¡ ƒƒ}|  ||dd¡ n&tt	d| 
d¡ ƒƒ}|  ||dd¡  q²d S )Ni £ r(   Z	setexpiryr   z--days=2r   r   r   r   r   r   zCan we run setexpiry with namesz#Expiry for user '%s' set to 2 days.rD   ZaccountExpiresé   z?Ensure account expires is within 5 seconds of the expected timei F z--filterz$(&(objectClass=user)(company=comp2))z--days=4z"Can we run setexpiry with a filterr   r   )r   Útimer3   r   r   r$   r&   r2   r   ÚintrG   ZassertWithin)	r'   r(   Ztwodaysr)   r*   r+   rH   ZexpiresZfourdaysr.   r.   r/   Útest_setexpiryC  s8    
ý
      ü  zUserCmdTestCase.test_setexpiryc           	   
   C   sº   |   ddddtjd  dtjd tjd f ¡\}}}|  |||d	¡ d
tjtjf }| jj	| j 
¡ tj|dgd}|  t|ƒdkd¡ |D ](}t|jdddƒ}|  ||d| ¡}qŒd S )Nr(   Úlistr   r   r   r   r   r   úError running listú0(&(objectClass=user)(userAccountControl:%s:=%u))Úsamaccountname©ÚbaseÚscopeÚ
expressionÚattrsr   úno users found in samdb©Úidxúuser '%s' not found©r3   r   r   r$   ÚldbÚOID_COMPARATOR_ANDr   ÚUF_NORMAL_ACCOUNTr   ÚsearchÚ	domain_dnÚSCOPE_SUBTREEÚ
assertTruerM   ÚstrrG   r[   ©	r'   r)   r*   r+   Úsearch_filterÚuserlistÚuserobjr   rH   r.   r.   r/   Ú	test_listi  s*    
ÿþ

ÿýÿzUserCmdTestCase.test_listc           
      C   sÄ   d}|   ddd|ddtjd  dtjd	 tjd
 f ¡\}}}|  |||d¡ dtjtjf }| jj	| j 
|¡tj|dgd}|  t|ƒdkd¡ |D ](}t|jdddƒ}|  ||d| ¡}	q–d S )NzCN=Usersr(   rh   z-br   r   r   r   r   r   ri   rj   rk   rl   r   rq   rr   rt   )r3   r   r   r$   rv   rw   r   rx   r   ry   Únormalize_dn_in_domainr{   r|   rM   r}   rG   r[   )
r'   Zbase_dnr)   r*   r+   r   r€   r   r   rH   r.   r.   r/   Útest_list_base_dn€  s,    
ÿþ

ÿýÿz!UserCmdTestCase.test_list_base_dnc           	      C   s¼   |   dddddtjd  dtjd tjd	 f ¡\}}}|  |||d
¡ dtjtjf }| jj	| j 
¡ tj|dgd}|  t|ƒdkd¡ |D ](}t|jdddƒ}|  ||d| ¡}qŽd S )Nr(   rh   z	--full-dnr   r   r   r   r   r   ri   rj   Zdnrl   r   rq   rr   rt   ru   r~   r.   r.   r/   Útest_list_full_dn—  s*    

ÿþ

ÿýÿz!UserCmdTestCase.test_list_full_dnc                 C   sœ   | j D ]}|  dd|d dddtjd  dtjd	 tjd
 f ¡\}}}|  |||d¡ d|d |d | j ¡ |d |d f }|  ||d|d  ¡ qd S )Nr(   Zshowr   z#--attributes=sAMAccountName,companyr   r   r   r   r   r   zError running showz9dn: CN=%s %s,CN=Users,%s
company: %s
sAMAccountName: %s

r<   r:   r   z$Unexpected show output for user '%s')r   r3   r   r   r$   r   rz   r%   )r'   r(   r)   r*   r+   Zexpected_outr.   r.   r/   Ú	test_show­  s(    


ÿü
ÿüÿÿzUserCmdTestCase.test_showc                 C   sZ  t | j d¡ƒ}|  dd|¡\}}}|  |||¡ |  |dd¡ |  d| |¡ | jD ]F}|  dd|d	 |¡\}}}|  |||d
¡ |  d|d	 |f |¡ qV|  dd|¡\}}}|  |¡ |  dt	| jƒ |¡ | jD ]T}d| j 
¡  }|  dd|d	 |¡\}}}|  |||d
¡ |  d|d	 |f |¡ qØ|  dd|¡\}}}|  |||d| ¡ d S )NzOU=movetestZour7   r   z$There shouldn't be any error messagezCreated ou "%s"r(   Zmover   zError running movezMoved user "%s" into "%s"r0   zFsubtree_delete: Unable to delete a non-leaf node (it has %d children)!zCN=Users,%szFailed to delete ou '%s')r}   r   rƒ   r3   r$   r%   r&   r   rF   rM   rz   )r'   Z
full_ou_dnr)   r*   r+   r(   Znew_dnr.   r.   r/   Ú	test_moveÂ  sJ    
ÿ

ÿÿ
ÿÿ
ÿ

ÿÿ
ÿzUserCmdTestCase.test_movec           	      C   s˜  zdd l }W n ty*   |  d¡ Y d S 0 t ¡ }z| |¡}W n ty`   |  d¡ Y d S 0 |d }|d u s~t|ƒdkr‚d}|  |d |d |d |d ||d d	œ¡}|  	d
d|d |d d|d  d|d  d|d  d|d  d|d  d|d  d|d  dddtj
d  d tj
d! tj
d" f ¡\}}}|  |||¡ |  |d#d$¡ |  d%|d  |¡ |  |¡ |  	d
d&|d ¡ |  d|d i¡}|  	d
d|d |d d|d  d|d  d|d  d|d  d|d  d|d  dd|d  d'|d(  d)|d*  d+|d,  d-|d.  ddtj
d  d tj
d! tj
d" f ¡\}}}|  |||¡ |  |d#d$¡ |  d%|d  |¡ |  |¡ |  	d
d&|d ¡ d S )/Nr   z1Skipping getpwent test, no 'pwd' module availablez5Skipping getpwent test, current EUID not found in NSSé   z	Foo GECOSé   rJ   rK   )r   ÚuidÚ	uidNumberÚ	gidNumberÚgecosÚ
loginShellr(   r7   r   r8   r9   r:   r;   r<   r=   r>   r?   r@   rA   rB   rC   r   ú
--gecos=%sr   z--rfc2307-from-nssr   r   r   r   r   r   r   r   r   r0   ú--login-shell=%srŽ   ú--uid=%srŠ   ú--uid-number=%sr‹   ú--gid-number=%srŒ   )ÚpwdÚImportErrorZskipTestr   ÚgeteuidÚgetpwuidÚKeyErrorrM   r"   r3   r   r$   r%   r&   Ú_check_posix_user)	r'   r”   rŠ   Úur   r(   r)   r*   r+   r.   r.   r/   Útest_getpwentâ  sz    

ú	






ö












ò

zUserCmdTestCase.test_getpwentc                 C   sR   |   ¡ |  d¡|   ¡ |   ¡ |   ¡ |   ¡ |   ¡ | j dd| j| jdœ
}| |¡ |S )zKcreate a user with random attribute values, you can specify base attributesrW   éd   )Úcount)
r   r8   r:   r<   r>   r@   r   rB   r   r   )Ú
randomNamerZ   rE   Ú_check_userÚupdate)r'   rm   r(   r.   r.   r/   r!   2  s    
ö
zUserCmdTestCase._randomUserc                 C   sX   |   i ¡}| |¡ |  ¡ |  ¡ |  ¡ |  ¡ |  ¡ | j| jdœ}| |¡ | |¡ |S )úucreate a user with random attribute values and additional RFC2307
        attributes, you can specify base attributes)rŠ   rŽ   r   r‹   rŒ   r   r   )r!   r    rž   Ú	randomXidÚ_create_posix_userr™   ©r'   rm   r(   ZposixAttributesr.   r.   r/   r"   C  s    

ù	

z UserCmdTestCase._randomPosixUserc                 C   sX   |   i ¡}| |¡ |  ¡ |  ¡ |  ¡ |  ¡ |  ¡ | j| jdœ}| |¡ | |¡ |S )r¡   )r‹   rŒ   rŠ   rŽ   r   r   r   )r!   r    r¢   rž   Ú_create_unix_userÚ_check_unix_userr¤   r.   r.   r/   r#   U  s    

ù	

zUserCmdTestCase._randomUnixUserc                 C   s”   |   |d ¡}|  d| d¡ d| ¡ |  d| d¡ |d ¡ |  d| d¡ |d ¡ |  d| d¡ |d ¡ |  d| d¡ |d ¡ d	S )
zD check if a user from SamDB has the same attributes as its template r   rD   z%(given-name)s %(surname)sÚtitler>   r   rB   r@   N)r2   r%   rG   ©r'   r(   rH   r.   r.   r/   rŸ   g  s    zUserCmdTestCase._check_userc                 C   s¦   |   |d ¡}|  d| d¡ |d ¡ |  d| d¡ |d ¡ |  d| d¡ d|d  ¡ |  d| d¡ d|d  ¡ |  d| d¡ |d ¡ |  |¡ dS )	zJ check if a posix_user from SamDB has the same attributes as its template r   rD   rŽ   r   r‹   rŒ   rŠ   N©r2   r%   rG   rŸ   r¨   r.   r.   r/   r™   q  s    z!UserCmdTestCase._check_posix_userc                 C   s¦   |   |d ¡}|  d| d¡ |d ¡ |  d| d¡ |d ¡ |  d| d¡ d|d  ¡ |  d| d¡ d|d  ¡ |  d| d¡ |d ¡ |  |¡ dS )	zI check if a unix_user from SamDB has the same attributes as its
template r   rD   rŽ   r   r‹   rŒ   rŠ   Nr©   r¨   r.   r.   r/   r¦   |  s    ÿÿz UserCmdTestCase._check_unix_userc                 C   sx   |   dd|d |d d|d  d|d  d	|d
  d|d  d|d  d|d  ddtjd  dtjd tjd f ¡S )Nr(   r7   r   r8   r9   r:   r;   r<   r=   r>   r?   r@   rA   rB   rC   r   r   r   r   r   r   r   ©r3   r   r   ©r'   r(   r.   r.   r/   rE   Š  s    





øzUserCmdTestCase._create_userc                 C   sª   |   dd|d |d d|d  d|d  d	|d
  d|d  d|d  d|d  d|d  d|d  d|d  d|d  d|d  ddtjd  dtjd tjd  f ¡S )!z+ create a new user with RFC2307 attributes r(   r7   r   r8   r9   r:   r;   r<   r=   r>   r?   r@   rA   rB   rC   r   r   r   r   rŽ   r‘   rŠ   r’   r‹   r“   rŒ   r   r   r   r   r   r   rª   r«   r.   r.   r/   r£   •  s    










óz"UserCmdTestCase._create_posix_userc                 C   sr   |   |¡ |  dd|d d|d  d|d  d|d	  d
|d  d|d  ddtjd  dtjd tjd f ¡S )z! Add RFC2307 attributes to a userr(   Zaddunixattrsr   rD   r‹   r“   rŒ   r   r   r   rŽ   r‘   rŠ   r   r   r   r   r   r   )rE   r3   r   r   r«   r.   r.   r/   r¥   ¦  s    






ÿùz!UserCmdTestCase._create_unix_userc                 C   sH   dt  |¡d| j ¡ f }| jj| j ¡ t j|d}|r@|d S d S d S )Nz,(&(sAMAccountName=%s)(objectCategory=%s,%s))z$CN=Person,CN=Schema,CN=Configuration)rm   rn   ro   r   )rv   Zbinary_encoder   rz   ry   r{   )r'   r   r   r€   r.   r.   r/   r2   ³  s    þzUserCmdTestCase._find_user)rJ   rK   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   r   r1   rI   rV   rc   rg   r‚   r„   r…   r†   r‡   r›   r!   r"   r#   rŸ   r™   r¦   rE   r£   r¥   r2   Ú__classcell__r.   r.   r,   r/   r   #   s6   !%  þ
Su& P
r   )r   re   r]   rv   Zsamba.tests.samba_tool.baser   Zsambar   r   r   Z	samba.ndrr   Zsamba.dcerpcr   Zsamba.compatr   r	   Zsamba.testsr
   r   r.   r.   r.   r/   Ú<module>   s   