sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-31 01:48:16 +03:00
Code
samba-mirror/selftest/knownfail.d/security-descriptors

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

5 lines
220 B
Plaintext
Raw Permalink Normal View History

pytest: compare Samba vs Windows SDDL security descriptors Can Samba understand Windows security descriptors? Does it parse SDDL the same way? Here we test on over 7000 SDDL/descriptor pairs and find the answer is pleasing. In later commits we will add more tests using different classes of ACE. The test cases are derived from fuzz seeds, exported to Windows via the script in the last commit, with the Windows descriptor bytes found using libcli/security/tests/windows/windows-sddl-test.py. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-09 14:15:27 +12:00
^samba.tests.security_descriptors.+SDDLvsDescriptorRegistryObjectRights.+
pytest: security_descriptors: tests without revision number hack ACL revision 4 (SECURITY_ACL_REVISION_ADS) is effectively a superset of revision 2 (SECURITY_ACL_REVISION_NT4), so any revision 2 ACL can be called revision 4 without any problem. But not vice versa: a revision 4 ACL can contain ACE types that a revision 2 ACL can't. The extra ACE types relate to objects. Samba currently simplifies things by calling all its ACLs revision 4, even if (as is commonly the case) the ACLs contain only revision 2 ACEs. On the other hand, Windows will use revision 2 whenever it can. In other tests we skip past this by forcing Windows ACLs to v4 before comparison. This test is to remind us of the incompatibility. It would not be hard to fix. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-09 14:15:27 +12:00
^samba.tests.security_descriptors.+SDDLvsDescriptorShortOrdinaryAclsNoMungeV4.+
libcli/security: add a parser for resource attribute ACE byte strings Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-02 15:28:15 +13:00
libcli/security/tests: remove duplicate TX-integer tests from oversized-ACLs We had two sets of test vectors (Windows ground-truth for SDDL compilation) that got mixed up. The "oversized ACLs" set is ACLs that contain repeated ACEs, like "D:P(D;;;;;MP)(D;;;;;MP)" -- Windows will assign a size to the ACL that is greater than the sum of the ACEs, while Samba will not (in part because we don't actually store a size for the ACL, instead calculating it on the fly from the size of the ACEs). The "TX integers" set is for resource attribute ACEs with octet-string data that contains pure integers (lacking '#' characters) in their SDDL, like «(RA;;;;;WD;("bar",TX,0x0,0077,00,0077,00))». We used to think that was weird, and that RA-TX ACEs should contain octet-strings in the conditional ACE style. But now we have realised it's not weird, it's normal, and we have fixed our handling of these ACEs. As a result of this mix-up, some of the tests labelled as "oversized ACLs" started passing when we fixed the TX integer problem, and that was confusing. All of the removed tests are already on the TX integer set -- the removed ones were duplicates. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-24 16:59:05 +13:00
samba.tests.security_descriptors.+SDDLvsDescriptorOverSizeAcls.+
Copy Permalink