sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-05 20:58:40 +03:00
Code

CVE-2022-32746 s4:dsdb:tests: Add test for deleting a disallowed SPN

Browse Source 
If an account has an SPN that requires Write Property to set, we should
still be able to delete it with just Validated Write.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
This commit is contained in:
Joseph Sutton 2022-06-21 15:37:15 +12:00 committed by Jule Anger
parent 16f3112687
commit c83967ad71
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/acl-spn-delete Normal file
View File

@ -0,0 +1 @@
^samba4.ldap.acl.python.*__main__.AclSPNTests.test_delete_disallowed_spn\(

26
source4/dsdb/tests/python/acl.py
View File

@ -2285,6 +2285,32 @@ class AclSPNTests(AclTests):
else:
self.fail(f'able to add disallowed SPN {not_allowed_spn}')
def test_delete_disallowed_spn(self):
# Grant Validated-SPN property.
mod = f'(OA;;SW;{security.GUID_DRS_VALIDATE_SPN};;{self.user_sid1})'
self.sd_utils.dacl_add_ace(self.computerdn, mod)
spn_base = f'HOST/{self.computername}'
not_allowed_spn = f'{spn_base}/{self.dcctx.get_domain_name()}'
# Add a disallowed SPN as admin.
msg = Message(Dn(self.ldb_admin, self.computerdn))
msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
FLAG_MOD_ADD,
'servicePrincipalName')
self.ldb_admin.modify(msg)
# Ensure we are able to delete a disallowed SPN.
msg = Message(Dn(self.ldb_user1, self.computerdn))
msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
FLAG_MOD_DELETE,
'servicePrincipalName')
try:
self.ldb_user1.modify(msg)
except LdbError:
self.fail(f'unable to delete disallowed SPN {not_allowed_spn}')
# tests SEC_ADS_LIST vs. SEC_ADS_LIST_OBJECT
@DynamicTestCase