sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Code

CVE-2023-0614 dsdb: Alter timeout test in large_ldap.py to be slower by matching on large objects

Browse Source 
This changes the slow aspect to be the object matching not the filter parsing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
This commit is contained in:
Andrew Bartlett 2023-03-03 10:31:40 +13:00 committed by Jule Anger
parent bf7b9d9d5e
commit 8712a2dc97
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source4/dsdb/tests/python/large_ldap.py
View File

@ -32,7 +32,7 @@ from samba.tests.subunitrun import SubunitOptions, TestProgram
import samba.getopt as options import samba.getopt as options
from samba.auth import system_session from samba.auth import system_session
from samba import ldb from samba import ldb, sd_utils
from samba.samdb import SamDB from samba.samdb import SamDB
from samba.ndr import ndr_unpack from samba.ndr import ndr_unpack
from samba import gensec from samba import gensec
@ -123,10 +123,13 @@ class LargeLDAPTest(samba.tests.TestCase):
def setUpClass(cls): def setUpClass(cls):
cls.ldb = SamDB(url, credentials=creds, session_info=system_session(lp), lp=lp) cls.ldb = SamDB(url, credentials=creds, session_info=system_session(lp), lp=lp)
cls.base_dn = cls.ldb.domain_dn() cls.base_dn = cls.ldb.domain_dn()
cls.sd_utils = sd_utils.SDUtils(cls.ldb)
cls.USER_NAME = "large_user" + format(random.randint(0, 99999), "05") + "-" cls.USER_NAME = "large_user" + format(random.randint(0, 99999), "05") + "-"
cls.OU_NAME="large_user_ou" + format(random.randint(0, 99999), "05") cls.OU_NAME="large_user_ou" + format(random.randint(0, 99999), "05")
cls.ou_dn = ldb.Dn(cls.ldb, "ou=" + cls.OU_NAME + "," + str(cls.base_dn)) cls.ou_dn = ldb.Dn(cls.ldb, "ou=" + cls.OU_NAME + "," + str(cls.base_dn))
samba.tests.delete_force(cls.ldb, cls.ou_dn, samba.tests.delete_force(cls.ldb, cls.ou_dn,
controls=['tree_delete:1']) controls=['tree_delete:1'])
@ -249,6 +252,7 @@ class LargeLDAPTest(samba.tests.TestCase):
self.assertGreater(count, count_jpeg) self.assertGreater(count, count_jpeg)
def test_timeout(self): def test_timeout(self):
policy_dn = ldb.Dn(self.ldb, policy_dn = ldb.Dn(self.ldb,
'CN=Default Query Policy,CN=Query-Policies,' 'CN=Default Query Policy,CN=Query-Policies,'
'CN=Directory Service,CN=Windows NT,CN=Services,' 'CN=Directory Service,CN=Windows NT,CN=Services,'
@ -286,9 +290,19 @@ class LargeLDAPTest(samba.tests.TestCase):
session_info=system_session(lp), session_info=system_session(lp),
lp=lp) lp=lp)
for x in range(200):
user_name = self.USER_NAME + format(x, "03")
ace = "(OD;;RP;{6bc69afa-7bd9-4184-88f5-28762137eb6a};;S-1-%d)" % x
dn = ldb.Dn(self.ldb, "cn=" + user_name + "," + str(self.ou_dn))
# add an ACE that denies access to the above random attr
# for a not-existing user. This makes each SD distinct
# and so will slow SD parsing.
self.sd_utils.dacl_add_ace(dn, ace)
# Create a large search expression that will take a long time to # Create a large search expression that will take a long time to
# evaluate. # evaluate.
expression = '(anr=l)' * 10000 expression = f'(jpegPhoto=*X*)' * 1000
expression = f'(|{expression})' expression = f'(|{expression})'
# Perform the LDAP search. # Perform the LDAP search.