[SCM] Samba Shared Repository - branch master updated
Andrew Bartlett
abartlet at samba.org
Mon Jan 18 06:50:03 UTC 2016
The branch, master has been updated
via 594778e ldb-samba: Expand testing of recursive search
via 10e3237 ldb-samba: Correct error reporting to match Windows
via 1d05f3b ldb-samba: Reenable recursive search
via a52bcaa ldb-samba: critical bugfix on original recursive search implementation
via 177ac58 ldb-samba: Implement transitive extended matching
via a2d49fa pidl: Change PyGetSetDef in generated python bindings to use C99 initialisers
from cff17f0 s3: smbd: Remove one more use of lp_posix_pathnames().
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 594778e580474d48b954866da06cc2d505f1d1ef
Author: Adrian Cochrane <adrianc at catalyst.net.nz>
Date: Mon Dec 7 10:07:26 2015 +1300
ldb-samba: Expand testing of recursive search
Signed-off-by: Adrian Cochrane <adrianc at catalyst.net.nz>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
Autobuild-Date(master): Mon Jan 18 07:49:43 CET 2016 on sn-devel-144
commit 10e32377a41d66566d8860cd5f02243feff61ce0
Author: Adrian Cochrane <adrianc at catalyst.net.nz>
Date: Tue Jan 12 13:11:03 2016 +1300
ldb-samba: Correct error reporting to match Windows
In some cases instead of replying with an error Windows instead returns
0 results.
Signed-off-by: Adrian Cochrane <adrianc at catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
commit 1d05f3bae722fe82db8160b76ec6e49771d687cc
Author: Adrian Cochrane <adrianc at catalyst.net.nz>
Date: Thu Jan 7 10:28:12 2016 +1300
ldb-samba: Reenable recursive search
In order for the recursive search module to work, we first
must stop asserting that any extended match rule is a DN (to be modified
per the extended DN munging), as this is not the case for this particular rule.
This reverts commit 8cacd5b8113fa30fb4ccaaf3193839660feb285f.
Signed-off-by: Adrian Cochrane <adrianc at catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
commit a52bcaaf2062e5e48695032e25b68aeff33ea301
Author: Adrian Cochrane <adrianc at catalyst.net.nz>
Date: Fri Jan 8 15:15:07 2016 +1300
ldb-samba: critical bugfix on original recursive search implementation
In the original patch (listed previously), when the search recurses it
will inevitably reallocate the visited list to a new array in memory.
When this happens the original patch didn't update it's reference to the
array.
This patch adds an extra level of indirection on the visited list in
order to fix this bug.
Signed-off-by: Adrian Cochrane <adrianc at catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
commit 177ac584c9bc444b951596f0ca740c04182c9db8
Author: Samuel Cabrero <samuelcabrero at kernevil.me>
Date: Fri Oct 24 17:52:47 2014 +0200
ldb-samba: Implement transitive extended matching
Documented in [MS-ADTS] section 3.1.1.3.4.4.3 LDAP_MATCHING_RULE_TRANSITIVE_EVAL
This allows a search filter such as:
member:1.2.840.113556.1.4.1941:=cn=user,cn=users,dc=samba,dc=example,dc=com
This searches not only the member attribute, but also any member
attributes that point at an object with this member in them. All the
various DN syntax types are supported, not just plain DNs.
Signed-off-by: Samuel Cabrero <samuelcabrero at kernevil.me>
(abartlet: Fixed compile error: return makes integer from pointer without a cast)
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
(returned to Samba by revert of
dc2d5ccd56ff8c59f3686a652ec3082069914bb4, returning the original
commit 2a22ba34cd6f28950246b54c6577c922c61f4fdb)
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Signed-off-by: Adrian Cochrane <adrianc at catalyst.net.nz>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
commit a2d49fa74f2a4b3cf8b22f4b5686d18f3204fcfb
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Jan 18 15:53:15 2016 +1300
pidl: Change PyGetSetDef in generated python bindings to use C99 initialisers
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Garming Sam <garming at catalyst.net.nz>
-----------------------------------------------------------------------
Summary of changes:
lib/ldb-samba/ldb_matching_rules.c | 342 +++++
.../secacl.h => lib/ldb-samba/ldb_matching_rules.h | 19 +-
lib/ldb-samba/ldif_handlers.c | 6 +
lib/ldb-samba/tests/match_rules.py | 1513 ++++++++++++++++++--
lib/ldb-samba/wscript_build | 2 +-
lib/ldb/common/ldb_match.c | 3 +-
pidl/lib/Parse/Pidl/Samba4/Python.pm | 11 +-
selftest/knownfail | 14 -
source4/dsdb/samdb/ldb_modules/extended_dn_in.c | 4 +-
9 files changed, 1774 insertions(+), 140 deletions(-)
create mode 100644 lib/ldb-samba/ldb_matching_rules.c
copy libcli/security/secacl.h => lib/ldb-samba/ldb_matching_rules.h (66%)
Changeset truncated at 500 lines:
diff --git a/lib/ldb-samba/ldb_matching_rules.c b/lib/ldb-samba/ldb_matching_rules.c
new file mode 100644
index 0000000..1692a73
--- /dev/null
+++ b/lib/ldb-samba/ldb_matching_rules.c
@@ -0,0 +1,342 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ ldb database library - Extended match rules
+
+ Copyright (C) 2014 Samuel Cabrero <samuelcabrero at kernevil.me>
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include <ldb_module.h>
+#include "dsdb/samdb/samdb.h"
+#include "ldb_matching_rules.h"
+
+static int ldb_eval_transitive_filter_helper(TALLOC_CTX *mem_ctx,
+ struct ldb_context *ldb,
+ const char *attr,
+ const struct dsdb_dn *dn_to_match,
+ const char *dn_oid,
+ struct dsdb_dn *to_visit,
+ struct dsdb_dn ***visited,
+ unsigned int *visited_count,
+ bool *matched)
+{
+ TALLOC_CTX *tmp_ctx;
+ int ret, i, j;
+ struct ldb_result *res;
+ struct ldb_message *msg;
+ struct ldb_message_element *el;
+ const char *attrs[] = { attr, NULL };
+
+ tmp_ctx = talloc_new(mem_ctx);
+ if (tmp_ctx == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ /*
+ * Fetch the entry to_visit
+ *
+ * NOTE: This is a new LDB search from the TOP of the module
+ * stack. This means that this search runs the whole stack
+ * from top to bottom.
+ *
+ * This may seem to be in-efficient, but it is also the only
+ * way to ensure that the ACLs for this search are applied
+ * correctly.
+ *
+ * Note also that we don't have the original request
+ * here, so we can not apply controls or timeouts here.
+ */
+ ret = dsdb_search_dn(ldb, tmp_ctx, &res, to_visit->dn, attrs, 0);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(tmp_ctx);
+ return ret;
+ }
+ if (res->count != 1) {
+ talloc_free(tmp_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ msg = res->msgs[0];
+
+ /* Fetch the attribute to match from the entry being visited */
+ el = ldb_msg_find_element(msg, attr);
+ if (el == NULL) {
+ /* This entry does not have the attribute to match */
+ talloc_free(tmp_ctx);
+ *matched = false;
+ return LDB_SUCCESS;
+ }
+
+ /*
+ * If the value to match is present in the attribute values of the
+ * current entry being visited, set matched to true and return OK
+ */
+ for (i=0; i<el->num_values; i++) {
+ struct dsdb_dn *dn;
+ dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], dn_oid);
+ if (dn == NULL) {
+ talloc_free(tmp_ctx);
+ *matched = false;
+ return LDB_ERR_INVALID_DN_SYNTAX;
+ }
+
+ if (ldb_dn_compare(dn_to_match->dn, dn->dn) == 0) {
+ talloc_free(tmp_ctx);
+ *matched = true;
+ return LDB_SUCCESS;
+ }
+ }
+
+ /*
+ * If arrived here, the value to match is not in the values of the
+ * entry being visited. Add the entry being visited (to_visit)
+ * to the visited array. The array is (re)allocated in the parent
+ * memory context.
+ */
+ if (visited == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ } else if (*visited == NULL) {
+ *visited = talloc_array(mem_ctx, struct dsdb_dn *, 1);
+ if (*visited == NULL) {
+ talloc_free(tmp_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ (*visited)[0] = to_visit;
+ (*visited_count) = 1;
+ } else {
+ *visited = talloc_realloc(mem_ctx, *visited, struct dsdb_dn *,
+ (*visited_count) + 1);
+ if (*visited == NULL) {
+ talloc_free(tmp_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ (*visited)[(*visited_count)] = to_visit;
+ (*visited_count)++;
+ }
+
+ /*
+ * steal to_visit into visited array context, as it has to live until
+ * the array is freed.
+ */
+ talloc_steal(*visited, to_visit);
+
+ /*
+ * Iterate over the values of the attribute of the entry being
+ * visited (to_visit) and follow them, calling this function
+ * recursively.
+ * If the value is in the visited array, skip it.
+ * Otherwise, follow the link and visit it.
+ */
+ for (i=0; i<el->num_values; i++) {
+ struct dsdb_dn *next_to_visit;
+ bool skip = false;
+
+ next_to_visit = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], dn_oid);
+ if (next_to_visit == NULL) {
+ talloc_free(tmp_ctx);
+ *matched = false;
+ return LDB_ERR_INVALID_DN_SYNTAX;
+ }
+
+ /*
+ * If the value is already in the visited array, skip it.
+ * Note the last element of the array is ignored because it is
+ * the current entry DN.
+ */
+ for (j=0; j < (*visited_count) - 1; j++) {
+ struct dsdb_dn *visited_dn = (*visited)[j];
+ if (ldb_dn_compare(visited_dn->dn,
+ next_to_visit->dn) == 0) {
+ skip = true;
+ break;
+ }
+ }
+ if (skip) {
+ talloc_free(next_to_visit);
+ continue;
+ }
+
+ /* If the value is not in the visited array, evaluate it */
+ ret = ldb_eval_transitive_filter_helper(tmp_ctx, ldb, attr,
+ dn_to_match, dn_oid,
+ next_to_visit,
+ visited, visited_count,
+ matched);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(tmp_ctx);
+ return ret;
+ }
+ if (*matched) {
+ talloc_free(tmp_ctx);
+ return LDB_SUCCESS;
+ }
+ }
+
+ talloc_free(tmp_ctx);
+ *matched = false;
+ return LDB_SUCCESS;
+}
+
+/*
+ * This function parses the linked attribute value to match, whose syntax
+ * will be one of the different DN syntaxes, into a ldb_dn struct.
+ */
+static int ldb_eval_transitive_filter(TALLOC_CTX *mem_ctx,
+ struct ldb_context *ldb,
+ const char *attr,
+ const struct ldb_val *value_to_match,
+ struct dsdb_dn *current_object_dn,
+ bool *matched)
+{
+ const struct dsdb_schema *schema;
+ const struct dsdb_attribute *schema_attr;
+ struct dsdb_dn *dn_to_match;
+ const char *dn_oid;
+ unsigned int count;
+ struct dsdb_dn **visited;
+
+ schema = dsdb_get_schema(ldb, mem_ctx);
+ if (schema == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ schema_attr = dsdb_attribute_by_lDAPDisplayName(schema, attr);
+ if (schema_attr == NULL) {
+ return LDB_ERR_NO_SUCH_ATTRIBUTE;
+ }
+
+ /* This is the DN syntax of the attribute being matched */
+ dn_oid = schema_attr->syntax->ldap_oid;
+
+ /*
+ * Build a ldb_dn struct holding the value to match, which is the
+ * value entered in the search filter
+ */
+ dn_to_match = dsdb_dn_parse(mem_ctx, ldb, value_to_match, dn_oid);
+ if (dn_to_match == NULL) {
+ *matched = false;
+ return LDB_SUCCESS;
+ }
+
+ return ldb_eval_transitive_filter_helper(mem_ctx, ldb, attr,
+ dn_to_match, dn_oid,
+ current_object_dn,
+ &visited, &count, matched);
+}
+
+/*
+ * This rule provides recursive search of a link attribute
+ *
+ * Documented in [MS-ADTS] section 3.1.1.3.4.4.3 LDAP_MATCHING_RULE_TRANSITIVE_EVAL
+ * This allows a search filter such as:
+ *
+ * member:1.2.840.113556.1.4.1941:=cn=user,cn=users,dc=samba,dc=example,dc=com
+ *
+ * This searches not only the member attribute, but also any member
+ * attributes that point at an object with this member in them. All the
+ * various DN syntax types are supported, not just plain DNs.
+ *
+ */
+static int ldb_comparator_trans(struct ldb_context *ldb,
+ const char *oid,
+ const struct ldb_message *msg,
+ const char *attribute_to_match,
+ const struct ldb_val *value_to_match,
+ bool *matched)
+{
+ const struct dsdb_schema *schema;
+ const struct dsdb_attribute *schema_attr;
+ struct ldb_dn *msg_dn;
+ struct dsdb_dn *dsdb_msg_dn;
+ TALLOC_CTX *tmp_ctx;
+ int ret;
+
+ tmp_ctx = talloc_new(ldb);
+ if (tmp_ctx == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ /*
+ * If the target attribute to match is not a linked attribute, then
+ * the filter evaluates to undefined
+ */
+ schema = dsdb_get_schema(ldb, tmp_ctx);
+ if (schema == NULL) {
+ talloc_free(tmp_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ schema_attr = dsdb_attribute_by_lDAPDisplayName(schema, attribute_to_match);
+ if (schema_attr == NULL) {
+ talloc_free(tmp_ctx);
+ return LDB_ERR_NO_SUCH_ATTRIBUTE;
+ }
+
+ /*
+ * This extended match filter is only valid for linked attributes,
+ * following the MS definition (the schema attribute has a linkID
+ * defined). See dochelp request 114111212024789 on cifs-protocols
+ * mailing list.
+ */
+ if (schema_attr->linkID == 0) {
+ *matched = false;
+ talloc_free(tmp_ctx);
+ return LDB_SUCCESS;
+ }
+
+ /* Duplicate original msg dn as the msg must not be modified */
+ msg_dn = ldb_dn_copy(tmp_ctx, msg->dn);
+ if (msg_dn == NULL) {
+ talloc_free(tmp_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ /*
+ * Build a dsdb dn from the message copied DN, which should be a plain
+ * DN syntax.
+ */
+ dsdb_msg_dn = dsdb_dn_construct(tmp_ctx, msg_dn, data_blob_null,
+ LDB_SYNTAX_DN);
+ if (dsdb_msg_dn == NULL) {
+ *matched = false;
+ return LDB_ERR_INVALID_DN_SYNTAX;
+ }
+
+ ret = ldb_eval_transitive_filter(tmp_ctx, ldb,
+ attribute_to_match,
+ value_to_match,
+ dsdb_msg_dn, matched);
+ talloc_free(tmp_ctx);
+ return ret;
+}
+
+
+int ldb_register_samba_matching_rules(struct ldb_context *ldb)
+{
+ struct ldb_extended_match_rule *transitive_eval;
+ int ret;
+
+ transitive_eval = talloc_zero(ldb, struct ldb_extended_match_rule);
+ transitive_eval->oid = SAMBA_LDAP_MATCH_RULE_TRANSITIVE_EVAL;
+ transitive_eval->callback = ldb_comparator_trans;
+ ret = ldb_register_extended_match_rule(ldb, transitive_eval);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(transitive_eval);
+ return ret;
+ }
+
+ return LDB_SUCCESS;
+}
diff --git a/libcli/security/secacl.h b/lib/ldb-samba/ldb_matching_rules.h
similarity index 66%
copy from libcli/security/secacl.h
copy to lib/ldb-samba/ldb_matching_rules.h
index c58d2c4..e969b3d 100644
--- a/libcli/security/secacl.h
+++ b/lib/ldb-samba/ldb_matching_rules.h
@@ -1,8 +1,9 @@
/*
Unix SMB/CIFS implementation.
- Samba utility functions
- Copyright (C) 2009 Jelmer Vernooij <jelmer at samba.org>
+ ldb database library - Extended match rules
+
+ Copyright (C) 2014 Samuel Cabrero <samuelcabrero at kernevil.me>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -18,14 +19,10 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-#ifndef _SECACL_H_
-#define _SECACL_H_
-
-#include "librpc/gen_ndr/security.h"
-
-struct security_acl *make_sec_acl(TALLOC_CTX *ctx, enum security_acl_revision revision,
- int num_aces, struct security_ace *ace_list);
-
+#ifndef _LDB_MATCHING_RULES_H_
+#define _LDB_MATCHING_RULES_H_
-#endif /*_SECACL_H_*/
+/* This rule provides recursive search of a link attribute */
+#define SAMBA_LDAP_MATCH_RULE_TRANSITIVE_EVAL "1.2.840.113556.1.4.1941"
+#endif /* _LDB_MATCHING_RULES_H_ */
diff --git a/lib/ldb-samba/ldif_handlers.c b/lib/ldb-samba/ldif_handlers.c
index 65f1d88..3b84084 100644
--- a/lib/ldb-samba/ldif_handlers.c
+++ b/lib/ldb-samba/ldif_handlers.c
@@ -1697,6 +1697,12 @@ int ldb_register_samba_handlers(struct ldb_context *ldb)
}
+ ret = ldb_register_samba_matching_rules(ldb);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(ldb);
+ return LDB_SUCCESS;
+ }
+
ret = ldb_set_opaque(ldb, "SAMBA_HANDLERS_REGISTERED", (void*)1);
if (ret != LDB_SUCCESS) {
return ret;
diff --git a/lib/ldb-samba/tests/match_rules.py b/lib/ldb-samba/tests/match_rules.py
index 1b30e9f..9c92b8b 100755
--- a/lib/ldb-samba/tests/match_rules.py
+++ b/lib/ldb-samba/tests/match_rules.py
@@ -16,18 +16,22 @@ from samba.auth import system_session
from samba.ndr import ndr_unpack
from ldb import Message, MessageElement, Dn, LdbError
from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
-from ldb import SCOPE_BASE, SCOPE_SUBTREE
+from ldb import SCOPE_BASE, SCOPE_SUBTREE, SCOPE_ONELEVEL
+# TODO I'm ignoring case in these tests for now.
+# This should be fixed to work inline with Windows.
+# The literal strings are in the case Windows uses.
+# Windows appear to preserve casing of the RDN and uppercase the other keys.
class MatchRulesTests(samba.tests.TestCase):
def setUp(self):
super(MatchRulesTests, self).setUp()
self.lp = lp
self.ldb = SamDB(host, credentials=creds, session_info=system_session(lp), lp=lp)
self.base_dn = self.ldb.domain_dn()
- self.ou = "ou=matchrulestest,%s" % self.base_dn
- self.ou_users = "ou=users,%s" % self.ou
- self.ou_groups = "ou=groups,%s" % self.ou
- self.ou_computers = "ou=computers,%s" % self.ou
+ self.ou = "OU=matchrulestest,%s" % self.base_dn
+ self.ou_users = "OU=users,%s" % self.ou
+ self.ou_groups = "OU=groups,%s" % self.ou
+ self.ou_computers = "OU=computers,%s" % self.ou
# Add a organizational unit to create objects
self.ldb.add({
@@ -98,10 +102,10 @@ class MatchRulesTests(samba.tests.TestCase):
"dn": "cn=g2,%s" % self.ou_groups,
"objectclass": "group" })
self.ldb.add({
- "dn": "cn=g3,%s" % self.ou_groups,
+ "dn": "cn=g4,%s" % self.ou_groups,
"objectclass": "group" })
self.ldb.add({
- "dn": "cn=g4,%s" % self.ou_groups,
+ "dn": "cn=g3,%s" % self.ou_groups,
"objectclass": "group" })
# Add four users
@@ -155,14 +159,14 @@ class MatchRulesTests(samba.tests.TestCase):
# u1 member of g1
m = Message()
- m.dn = Dn(self.ldb, "cn=g1,%s" % self.ou_groups)
- m["member"] = MessageElement("cn=u1,%s" % self.ou_users,
+ m.dn = Dn(self.ldb, "CN=g1,%s" % self.ou_groups)
+ m["member"] = MessageElement("CN=u1,%s" % self.ou_users,
FLAG_MOD_ADD, "member")
self.ldb.modify(m)
# u2 member of g2
m = Message()
- m.dn = Dn(self.ldb, "cn=g2,%s" % self.ou_groups)
+ m.dn = Dn(self.ldb, "CN=g2,%s" % self.ou_groups)
m["member"] = MessageElement("cn=u2,%s" % self.ou_users,
FLAG_MOD_ADD, "member")
self.ldb.modify(m)
@@ -170,7 +174,7 @@ class MatchRulesTests(samba.tests.TestCase):
# u3 member of g3
m = Message()
m.dn = Dn(self.ldb, "cn=g3,%s" % self.ou_groups)
- m["member"] = MessageElement("cn=u3,%s" % self.ou_users,
+ m["member"] = MessageElement("CN=u3,%s" % self.ou_users,
FLAG_MOD_ADD, "member")
self.ldb.modify(m)
@@ -183,7 +187,7 @@ class MatchRulesTests(samba.tests.TestCase):
# g3 member of g4
m = Message()
- m.dn = Dn(self.ldb, "cn=g4,%s" % self.ou_groups)
+ m.dn = Dn(self.ldb, "CN=g4,%s" % self.ou_groups)
m["member"] = MessageElement("cn=g3,%s" % self.ou_groups,
FLAG_MOD_ADD, "member")
self.ldb.modify(m)
@@ -191,7 +195,7 @@ class MatchRulesTests(samba.tests.TestCase):
# g2 member of g3
m = Message()
m.dn = Dn(self.ldb, "cn=g3,%s" % self.ou_groups)
- m["member"] = MessageElement("cn=g2,%s" % self.ou_groups,
+ m["member"] = MessageElement("CN=g2,%s" % self.ou_groups,
FLAG_MOD_ADD, "member")
self.ldb.modify(m)
@@ -294,115 +298,159 @@ class MatchRulesTests(samba.tests.TestCase):
res1 = self.ldb.search("cn=g4,%s" % self.ou_groups,
scope=SCOPE_BASE,
expression="member=cn=u1,%s" % self.ou_users)
- self.assertTrue(len(res1) == 0)
+ self.assertEqual(len(res1), 0)
--
Samba Shared Repository
More information about the samba-cvs
mailing list