mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
b29793ffde
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
5796 lines
245 KiB
Python
Executable File
5796 lines
245 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
# This is unit with tests for LDAP access checks
|
|
|
|
import optparse
|
|
import sys
|
|
import base64
|
|
import re
|
|
sys.path.insert(0, "bin/python")
|
|
import samba
|
|
|
|
from samba.tests import DynamicTestCase
|
|
from samba.tests.subunitrun import SubunitOptions, TestProgram
|
|
from samba.common import get_string
|
|
|
|
import samba.getopt as options
|
|
from samba.join import DCJoinContext
|
|
|
|
from ldb import (
|
|
SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE, LdbError, ERR_NO_SUCH_OBJECT,
|
|
ERR_UNWILLING_TO_PERFORM, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
from ldb import ERR_CONSTRAINT_VIOLATION
|
|
from ldb import ERR_OPERATIONS_ERROR
|
|
from ldb import Message, MessageElement, Dn
|
|
from ldb import FLAG_MOD_REPLACE, FLAG_MOD_ADD, FLAG_MOD_DELETE
|
|
from samba.dcerpc import security, drsuapi, misc
|
|
|
|
from samba.auth import system_session
|
|
from samba import gensec, sd_utils, werror
|
|
from samba.samdb import SamDB
|
|
from samba.credentials import Credentials, DONT_USE_KERBEROS
|
|
import samba.tests
|
|
from samba.tests import delete_force
|
|
import samba.dsdb
|
|
from samba.tests.password_test import PasswordCommon
|
|
from samba.ndr import ndr_pack
|
|
|
|
parser = optparse.OptionParser("acl.py [options] <host>")
|
|
sambaopts = options.SambaOptions(parser)
|
|
parser.add_option_group(sambaopts)
|
|
parser.add_option_group(options.VersionOptions(parser))
|
|
|
|
# use command line creds if available
|
|
credopts = options.CredentialsOptions(parser)
|
|
parser.add_option_group(credopts)
|
|
subunitopts = SubunitOptions(parser)
|
|
parser.add_option_group(subunitopts)
|
|
|
|
opts, args = parser.parse_args()
|
|
|
|
if len(args) < 1:
|
|
parser.print_usage()
|
|
sys.exit(1)
|
|
|
|
host = args[0]
|
|
if "://" not in host:
|
|
ldaphost = "ldap://%s" % host
|
|
else:
|
|
ldaphost = host
|
|
start = host.rindex("://")
|
|
host = host.lstrip(start + 3)
|
|
|
|
lp = sambaopts.get_loadparm()
|
|
creds = credopts.get_credentials(lp)
|
|
creds.set_gensec_features(creds.get_gensec_features() | gensec.FEATURE_SEAL)
|
|
|
|
#
|
|
# Tests start here
|
|
#
|
|
|
|
|
|
class AclTests(samba.tests.TestCase):
|
|
|
|
def setUp(self):
|
|
super(AclTests, self).setUp()
|
|
|
|
strict_checking = samba.tests.env_get_var_value('STRICT_CHECKING', allow_missing=True)
|
|
if strict_checking is None:
|
|
strict_checking = '1'
|
|
self.strict_checking = bool(int(strict_checking))
|
|
|
|
self.ldb_admin = SamDB(ldaphost, credentials=creds, session_info=system_session(lp), lp=lp)
|
|
self.base_dn = self.ldb_admin.domain_dn()
|
|
self.domain_sid = security.dom_sid(self.ldb_admin.get_domain_sid())
|
|
self.user_pass = "samba123@"
|
|
self.configuration_dn = self.ldb_admin.get_config_basedn().get_linearized()
|
|
self.sd_utils = sd_utils.SDUtils(self.ldb_admin)
|
|
self.addCleanup(self.delete_admin_connection)
|
|
# used for anonymous login
|
|
self.creds_tmp = Credentials()
|
|
self.creds_tmp.set_username("")
|
|
self.creds_tmp.set_password("")
|
|
self.creds_tmp.set_domain(creds.get_domain())
|
|
self.creds_tmp.set_realm(creds.get_realm())
|
|
self.creds_tmp.set_workstation(creds.get_workstation())
|
|
print("baseDN: %s" % self.base_dn)
|
|
|
|
# set AttributeAuthorizationOnLDAPAdd and BlockOwnerImplicitRights
|
|
self.set_heuristic(samba.dsdb.DS_HR_ATTR_AUTHZ_ON_LDAP_ADD, b'11')
|
|
|
|
def set_heuristic(self, index, values):
|
|
self.assertGreater(index, 0)
|
|
self.assertLess(index, 30)
|
|
self.assertIsInstance(values, bytes)
|
|
|
|
# Get the old "dSHeuristics" if it was set
|
|
dsheuristics = self.ldb_admin.get_dsheuristics()
|
|
# Reset the "dSHeuristics" as they were before
|
|
self.addCleanup(self.ldb_admin.set_dsheuristics, dsheuristics)
|
|
# Set the "dSHeuristics" to activate the correct behaviour
|
|
default_heuristics = b"000000000100000000020000000003"
|
|
if dsheuristics is None:
|
|
dsheuristics = b""
|
|
dsheuristics += default_heuristics[len(dsheuristics):]
|
|
dsheuristics = (dsheuristics[:index - 1] +
|
|
values +
|
|
dsheuristics[index - 1 + len(values):])
|
|
self.ldb_admin.set_dsheuristics(dsheuristics)
|
|
|
|
def get_user_dn(self, name):
|
|
return "CN=%s,CN=Users,%s" % (name, self.base_dn)
|
|
|
|
def get_ldb_connection(self, target_username, target_password):
|
|
creds_tmp = Credentials()
|
|
creds_tmp.set_username(target_username)
|
|
creds_tmp.set_password(target_password)
|
|
creds_tmp.set_domain(creds.get_domain())
|
|
creds_tmp.set_realm(creds.get_realm())
|
|
creds_tmp.set_workstation(creds.get_workstation())
|
|
creds_tmp.set_gensec_features(creds_tmp.get_gensec_features()
|
|
| gensec.FEATURE_SEAL)
|
|
creds_tmp.set_kerberos_state(DONT_USE_KERBEROS) # kinit is too expensive to use in a tight loop
|
|
ldb_target = SamDB(url=ldaphost, credentials=creds_tmp, lp=lp)
|
|
return ldb_target
|
|
|
|
# Test if we have any additional groups for users than default ones
|
|
def assert_user_no_group_member(self, username):
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % self.get_user_dn(username))
|
|
try:
|
|
self.assertEqual(res[0]["memberOf"][0], "")
|
|
except KeyError:
|
|
pass
|
|
else:
|
|
self.fail()
|
|
|
|
def delete_admin_connection(self):
|
|
del self.sd_utils
|
|
del self.ldb_admin
|
|
|
|
# tests on ldap add operations
|
|
|
|
|
|
class AclAddTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclAddTests, self).setUp()
|
|
# Domain admin that will be creator of OU parent-child structure
|
|
self.usr_admin_owner = "acl_add_user1"
|
|
# Second domain admin that will not be creator of OU parent-child structure
|
|
self.usr_admin_not_owner = "acl_add_user2"
|
|
# Regular user
|
|
self.regular_user = "acl_add_user3"
|
|
self.regular_user2 = "acl_add_user4"
|
|
self.regular_user3 = "acl_add_user5"
|
|
self.test_user1 = "test_add_user1"
|
|
self.test_user2 = "test_add_user2"
|
|
self.test_user3 = "test_add_user3"
|
|
self.test_user4 = "test_add_user4"
|
|
self.test_group1 = "test_add_group1"
|
|
self.ou1 = "OU=test_add_ou1"
|
|
self.ou2 = "OU=test_add_ou2,%s" % self.ou1
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user2))
|
|
self.ldb_admin.newuser(self.usr_admin_owner, self.user_pass)
|
|
self.ldb_admin.newuser(self.usr_admin_not_owner, self.user_pass)
|
|
self.ldb_admin.newuser(self.regular_user, self.user_pass)
|
|
self.ldb_admin.newuser(self.regular_user2, self.user_pass)
|
|
|
|
# add admins to the Domain Admins group
|
|
self.ldb_admin.add_remove_group_members("Domain Admins", [self.usr_admin_owner],
|
|
add_members_operation=True)
|
|
self.ldb_admin.add_remove_group_members("Domain Admins", [self.usr_admin_not_owner],
|
|
add_members_operation=True)
|
|
|
|
self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner, self.user_pass)
|
|
self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner, self.user_pass)
|
|
self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
|
|
self.ldb_user2 = self.get_ldb_connection(self.regular_user2, self.user_pass)
|
|
|
|
def tearDown(self):
|
|
super(AclAddTests, self).tearDown()
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" %
|
|
(self.test_user1, self.ou2, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" %
|
|
(self.test_user1, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" %
|
|
(self.test_user2, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" %
|
|
(self.test_user3, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" %
|
|
(self.test_user4, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" %
|
|
(self.test_group1, self.ou2, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=test_computer2,%s,%s" %
|
|
(self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=test_computer1,%s,%s" %
|
|
(self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "%s,%s" % (self.ou2, self.base_dn))
|
|
delete_force(self.ldb_admin, "%s,%s" % (self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user2))
|
|
delete_force(self.ldb_admin, self.get_user_dn("test_add_anonymous"))
|
|
|
|
del self.ldb_notowner
|
|
del self.ldb_owner
|
|
del self.ldb_user
|
|
del self.ldb_user2
|
|
|
|
# Make sure top OU is deleted (and so everything under it)
|
|
def assert_top_ou_deleted(self):
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s,%s)" % (
|
|
"OU=test_add_ou1", self.base_dn))
|
|
self.assertEqual(len(res), 0)
|
|
|
|
def test_add_u1(self):
|
|
"""Testing OU with the rights of Domain Admin not creator of the OU """
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.usr_admin_not_owner))
|
|
mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Test user and group creation with another domain admin's credentials
|
|
self.ldb_notowner.newuser(self.test_user1, self.user_pass, userou=self.ou2)
|
|
self.ldb_notowner.newgroup("test_add_group1", groupou="OU=test_add_ou2,OU=test_add_ou1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
# Make sure we HAVE created the two objects -- user and group
|
|
# !!! We should not be able to do that, but however because of ACE ordering our inherited Deny ACE
|
|
# !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
|
|
self.assertGreater(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
|
|
self.assertGreater(len(res), 0)
|
|
|
|
def test_add_u2(self):
|
|
"""Testing OU with the regular user that has no rights granted over the OU """
|
|
self.assert_top_ou_deleted()
|
|
# Create a parent-child OU structure with domain admin credentials
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
|
|
# Test user and group creation with regular user credentials
|
|
try:
|
|
self.ldb_user.newuser(self.test_user1, self.user_pass, userou=self.ou2)
|
|
self.ldb_user.newgroup("test_add_group1", groupou="OU=test_add_ou2,OU=test_add_ou1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
except LdbError as e:
|
|
(num, _) = e.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
# Make sure we HAVEN'T created any of two objects -- user or group
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
|
|
self.assertEqual(len(res), 0)
|
|
|
|
def test_add_u3(self):
|
|
"""Testing OU with the rights of regular user granted the right 'Create User child objects' """
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
|
|
# Test user and group creation with granted user only to one of the objects
|
|
self.ldb_user.newuser(self.test_user1, self.user_pass, userou=self.ou2, setpassword=False)
|
|
try:
|
|
self.ldb_user.newgroup("test_add_group1", groupou="OU=test_add_ou2,OU=test_add_ou1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
except LdbError as e1:
|
|
(num, _) = e1.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
# Make sure we HAVE created the one of two objects -- user
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s,%s)" %
|
|
("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1",
|
|
self.base_dn))
|
|
self.assertNotEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s,%s)" %
|
|
("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1",
|
|
self.base_dn))
|
|
self.assertEqual(len(res), 0)
|
|
|
|
def test_add_u4(self):
|
|
""" 4 Testing OU with the rights of Domain Admin creator of the OU"""
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
|
|
self.ldb_owner.newuser(self.test_user1, self.user_pass, userou=self.ou2)
|
|
self.ldb_owner.newgroup("test_add_group1", groupou="OU=test_add_ou2,OU=test_add_ou1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
# Make sure we have successfully created the two objects -- user and group
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
|
|
self.assertGreater(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
|
|
self.assertGreater(len(res), 0)
|
|
|
|
def test_add_c1(self):
|
|
"""Testing adding a computer object with the rights of regular user granted the right 'Create Computer child objects' """
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
|
|
# Add a computer object, specifying an explicit SD to grant WP to the creator
|
|
print("Test adding a user with explicit nTSecurityDescriptor")
|
|
wp_ace = "(A;;WP;;;%s)" % str(user_sid)
|
|
tmp_desc = security.descriptor.from_sddl("D:%s" % wp_ace, self.domain_sid)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user1, self.base_dn)
|
|
samaccountname = self.test_user1 + "$"
|
|
# This should fail, the user has no WD or WO
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user1,
|
|
"nTSecurityDescriptor": ndr_pack(tmp_desc)})
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_add_c2(self):
|
|
"""Testing adding a computer object with the rights of regular user granted the right 'Create User child objects' and WO"""
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Grant WO, we should still not be able to specify a DACL
|
|
mod = "(A;CI;WO;;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Add a computer object, specifying an explicit SD to grant WP to the creator
|
|
print("Test adding a user with explicit nTSecurityDescriptor")
|
|
wp_ace = "(A;;WP;;;%s)" % str(user_sid)
|
|
tmp_desc = security.descriptor.from_sddl("D:%s" % wp_ace, self.domain_sid)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user1, self.base_dn)
|
|
samaccountname = self.test_user1 + "$"
|
|
# This should fail, the user has no WD
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user1,
|
|
"nTSecurityDescriptor": ndr_pack(tmp_desc)})
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
# We still cannot modify the owner or group
|
|
sd_sddl = f"O:{user_sid}G:{user_sid}"
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user1,
|
|
"nTSecurityDescriptor": ndr_pack(tmp_desc)})
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_add_c3(self):
|
|
"""Testing adding a computer object with the rights of regular user granted the right 'Create Computer child objects' and WD"""
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Grant WD, we should still not be able to specify a DACL
|
|
mod = "(A;CI;WD;;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Add a computer object, specifying an explicit SD to grant WP to the creator
|
|
print("Test adding a user with explicit nTSecurityDescriptor")
|
|
wp_ace = "(A;;WP;;;%s)" % str(user_sid)
|
|
sd_sddl = f"O:{user_sid}G:BA"
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user1, self.base_dn)
|
|
samaccountname = self.test_user1 + "$"
|
|
# The user has no WO, but this succeeds, because WD means we skip further per-attribute checks
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user1,
|
|
"nTSecurityDescriptor": ndr_pack(tmp_desc)})
|
|
except LdbError as e3:
|
|
self.fail(str(e3))
|
|
|
|
# we should be able to modify the DACL
|
|
tmp_desc = security.descriptor.from_sddl("D:%s" % wp_ace, self.domain_sid)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user2, self.base_dn)
|
|
samaccountname = self.test_user2 + "$"
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user2,
|
|
"nTSecurityDescriptor": ndr_pack(tmp_desc)})
|
|
except LdbError as e3:
|
|
self.fail(str(e3))
|
|
|
|
# verify the ace is present
|
|
new_sd = self.sd_utils.get_sd_as_sddl("CN=test_add_user2,OU=test_add_ou1,%s" %
|
|
self.base_dn)
|
|
self.assertIn(wp_ace, new_sd)
|
|
|
|
def test_add_c4(self):
|
|
"""Testing adding a computer object with the rights of regular user granted the right 'Create User child objects' and WDWO"""
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Grant WD and WO, we should be able to update the SD
|
|
mod = "(A;CI;WDWO;;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# Add a computer object, specifying an explicit SD to grant WP to the creator
|
|
print("Test adding a user with explicit nTSecurityDescriptor")
|
|
wp_ace = "(A;;WP;;;%s)" % str(user_sid)
|
|
sd_sddl = "O:%sG:BAD:(A;;WP;;;%s)" % (str(user_sid), str(user_sid))
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user1, self.base_dn)
|
|
samaccountname = self.test_user1 + "$"
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user1,
|
|
"nTSecurityDescriptor": ndr_pack(tmp_desc)})
|
|
except LdbError as e3:
|
|
self.fail(str(e3))
|
|
|
|
# verify the owner and group is present
|
|
new_sd = self.sd_utils.get_sd_as_sddl("CN=test_add_user1,OU=test_add_ou1,%s" %
|
|
self.base_dn)
|
|
self.assertIn(f"O:{user_sid}G:BA", new_sd)
|
|
self.assertIn(wp_ace, new_sd)
|
|
|
|
def test_add_c5(self):
|
|
"""Testing adding a computer with an optional attribute """
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# servicePrincipalName
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user3, self.base_dn)
|
|
samaccountname = self.test_user3 + "$"
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user3,
|
|
"department": "Ministry of Silly Walks"})
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
# grant WP for that attribute and try again
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_DEPARTMENT};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user3,
|
|
"department": "Ministry of Silly Walks"})
|
|
except LdbError as e3:
|
|
self.fail(str(e3))
|
|
|
|
def test_add_c6(self):
|
|
"""Test creating a computer with a mandatory attribute(sAMAccountName)"""
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# servicePrincipalName
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
# userAccountControl
|
|
mod = f"(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_USER_ACCOUNT_CONTROL};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
dn = "CN=%s,OU=test_add_ou1,%s" % (self.test_user4, self.base_dn)
|
|
samaccountname = self.test_user4 + "$"
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "host/" + self.test_user4})
|
|
except LdbError as e3:
|
|
self.fail(str(e3))
|
|
|
|
def test_add_computer1(self):
|
|
"""Testing Computer with the rights of regular user granted the right 'Create Computer child objects' """
|
|
self.assert_top_ou_deleted()
|
|
# Change descriptor for top level OU
|
|
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = f"(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
mod = f"(OA;CI;SW;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;CO)"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
|
|
# add a Computer object with servicePrincipalName
|
|
# Creator-Owner has SW from the default SD
|
|
dn = "CN=test_computer1,OU=test_add_ou1,%s" % (self.base_dn)
|
|
samaccountname = "test_computer1$"
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "nosuchservice/abcd/abcd"})
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
if self.strict_checking:
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.assertIn(num, (ERR_INSUFFICIENT_ACCESS_RIGHTS,
|
|
ERR_CONSTRAINT_VIOLATION))
|
|
else:
|
|
self.fail()
|
|
|
|
# Inherited Deny from the parent will not work, because of ordering rules
|
|
mod = f"(OD;CI;SW;{samba.dsdb.DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME};;{user_sid})"
|
|
self.sd_utils.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
|
|
try:
|
|
self.ldb_user.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"servicePrincipalName": "nosuchservice/abcd/abcd"})
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
if self.strict_checking:
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.assertIn(num, (ERR_INSUFFICIENT_ACCESS_RIGHTS,
|
|
ERR_CONSTRAINT_VIOLATION))
|
|
else:
|
|
self.fail()
|
|
|
|
def test_add_optional_attr(self):
|
|
'''Show that adding a computer object with an optional attribute is disallowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_domain_admins(self):
|
|
'''Show that adding a computer object with an optional attribute is allowed if the user is a Domain Administrator'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.ldb_admin.add_remove_group_members('Domain Admins',
|
|
[self.regular_user],
|
|
add_members_operation=True)
|
|
ldb_domain_admin = self.get_ldb_connection(self.regular_user,
|
|
self.user_pass)
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
ldb_domain_admin.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_enterprise_admins(self):
|
|
'''Show that adding a computer object with an optional attribute is allowed if the user is an Enterprise Administrator'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.ldb_admin.add_remove_group_members('Enterprise Admins',
|
|
[self.regular_user],
|
|
add_members_operation=True)
|
|
ldb_enterprise_admin = self.get_ldb_connection(self.regular_user,
|
|
self.user_pass)
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
ldb_enterprise_admin.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_non_computer(self):
|
|
'''Show that adding a non-computer object with an optional attribute is allowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_USER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = self.test_user1
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'user',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_derived_computer(self):
|
|
'''Show that adding an object derived from computer with an optional attribute is disallowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_MANAGED_SERVICE_ACCOUNT};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'msDS-ManagedServiceAccount',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_write_dac(self):
|
|
'''Show that adding a computer object with an optional attribute is allowed if the security descriptor gives WRITE_DAC access'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_system_must_contain(self):
|
|
'''Show that adding a computer object with only systemMustContain attributes is allowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'instanceType': '4',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_system_must_contain_denied(self):
|
|
'''Show that adding a computer object with only systemMustContain attributes is allowed, even when explicitly denied'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(D;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_INSTANCE_TYPE};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'instanceType': '4',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_unicode_pwd(self):
|
|
'''Show that adding a computer object with a unicodePwd is allowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
password = 'Secret007'
|
|
utf16pw = f'"{password}"'.encode('utf-16-le')
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'unicodePwd': utf16pw,
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_user_password(self):
|
|
'''Show that adding a computer object with a userPassword is allowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
password = 'Secret007'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'userPassword': password,
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_user_password_denied(self):
|
|
'''Show that adding a computer object with a userPassword is allowed, even when explicitly denied'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(D;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_USER_PASSWORD};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
password = 'Secret007'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'userPassword': password,
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_clear_text_password(self):
|
|
'''Show that adding a computer object with a clearTextPassword is allowed
|
|
|
|
Note: this does not work on Windows.'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
password = 'Secret007'.encode('utf-16-le')
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'clearTextPassword': password,
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_disallowed_attr(self):
|
|
'''Show that adding a computer object with a denied attribute is disallowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(D;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_MS_SFU_30};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_allowed_attr(self):
|
|
'''Show that adding a computer object with an allowed attribute is allowed'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_MS_SFU_30};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_optional_attr_heuristic_0(self):
|
|
'''Show that adding a computer object with an optional attribute is allowed when AttributeAuthorizationOnLDAPAdd == 0'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_ATTR_AUTHZ_ON_LDAP_ADD, b'0')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_optional_attr_heuristic_2(self):
|
|
'''Show that adding a computer object with an optional attribute is allowed when AttributeAuthorizationOnLDAPAdd == 2'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_ATTR_AUTHZ_ON_LDAP_ADD, b'2')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_security_descriptor_implicit_right(self):
|
|
'''Show that adding a computer object with a security descriptor is allowed when BlockOwnerImplicitRights != 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'0')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'O:{user_sid}G:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_security_descriptor_implicit_right_optional_attr(self):
|
|
'''Show that adding a computer object with a security descriptor and an optional attribute is disallowed when BlockOwnerImplicitRights != 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'0')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'O:{user_sid}G:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'msSFU30Name': 'foo',
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_explicit_right(self):
|
|
'''Show that a computer object with a security descriptor can be added if BlockOwnerImplicitRights == 1 and WRITE_DAC is granted'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = (f'O:{user_sid}G:{user_sid}'
|
|
f'D:(A;;WP;;;{user_sid})')
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_security_descriptor_explicit_right_no_owner_disallow(self):
|
|
'''Show that a computer object with a security descriptor can be added if BlockOwnerImplicitRights == 1, WRITE_DAC is granted, and WRITE_OWNER is denied'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(D;CI;WO;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'D:(A;;WP;;;{user_sid})'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_security_descriptor_explicit_right_owner_disallow(self):
|
|
'''Show that a computer object with a security descriptor containing an owner and group can be added if BlockOwnerImplicitRights == 1, WRITE_DAC is granted, and WRITE_OWNER is denied'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(D;CI;WO;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = (f'O:{user_sid}G:{user_sid}'
|
|
f'D:(A;;WP;;;{user_sid})')
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_security_descriptor_explicit_right_sacl(self):
|
|
'''Show that adding a computer object with a security descriptor containing a SACL is disallowed if BlockOwnerImplicitRights == 1 and WRITE_DAC is granted'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = (f'O:{user_sid}G:{user_sid}'
|
|
f'D:(A;;WP;;;{user_sid})S:(A;;WP;;;{user_sid})')
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
if self.strict_checking:
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
self.assertIn(f'{werror.WERR_PRIVILEGE_NOT_HELD:08X}', estr)
|
|
else:
|
|
self.assertIn(num, (ERR_CONSTRAINT_VIOLATION,
|
|
ERR_INSUFFICIENT_ACCESS_RIGHTS))
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_explicit_right_owner_not_us(self):
|
|
'''Show that adding a computer object with a security descriptor owned by another is disallowed if BlockOwnerImplicitRights == 1 and WRITE_DAC is granted'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = 'O:BA'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
self.assertIn(f'{werror.WERR_INVALID_OWNER:08X}', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_explicit_right_owner_not_us_admin(self):
|
|
'''Show that adding a computer object with a security descriptor owned by another is allowed if BlockOwnerImplicitRights == 1, WRITE_DAC is granted, and we are in Domain Admins'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WD;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = 'O:BA'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_no_implicit_right(self):
|
|
'''Show that adding a computer object without a security descriptor is allowed when BlockOwnerImplicitRights == 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
})
|
|
except LdbError as err:
|
|
self.fail(err)
|
|
|
|
def test_add_security_descriptor_owner(self):
|
|
'''Show that adding a computer object with a security descriptor containing an owner is disallowed when BlockOwnerImplicitRights == 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'O:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_owner_implicit(self):
|
|
'''Show that adding a computer object with a security descriptor containing an owner is disallowed when BlockOwnerImplicitRights == 1, even when we are the owner of the OU security descriptor'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
|
|
ou_controls = [
|
|
f'sd_flags:1:{security.SECINFO_OWNER|security.SECINFO_DACL}']
|
|
ou_sddl = (f'O:{user_sid}'
|
|
f'D:(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(f'{self.ou1},{self.base_dn}', ou_desc,
|
|
controls=ou_controls)
|
|
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'O:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_owner_explicit_right(self):
|
|
'''Show that adding a computer object with a security descriptor containing an owner is disallowed when BlockOwnerImplicitRights == 1, even with WO'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WO;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'O:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_group(self):
|
|
'''Show that adding a computer object with a security descriptor containing an group is disallowed when BlockOwnerImplicitRights == 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'G:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_group_explicit_right(self):
|
|
'''Show that adding a computer object with a security descriptor containing an group is disallowed when BlockOwnerImplicitRights == 1, even with WO'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(A;CI;WO;;;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'G:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_group_implicit(self):
|
|
'''Show that adding a computer object with a security descriptor containing an group is disallowed when BlockOwnerImplicitRights == 1, even when we are the owner of the OU security descriptor'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
|
|
ou_controls = [
|
|
f'sd_flags:1:{security.SECINFO_OWNER|security.SECINFO_DACL}']
|
|
ou_sddl = (f'O:{user_sid}'
|
|
f'D:(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(f'{self.ou1},{self.base_dn}', ou_desc,
|
|
controls=ou_controls)
|
|
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'G:{user_sid}'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_dacl(self):
|
|
'''Show that adding a computer object with a security descriptor containing a DACL is disallowed when BlockOwnerImplicitRights == 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'D:(A;;WP;;;{user_sid})'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_dacl_implicit(self):
|
|
'''Show that adding a computer object with a security descriptor containing a DACL is disallowed when BlockOwnerImplicitRights == 1, even when we are the owner of the OU security descriptor'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
|
|
ou_controls = [
|
|
f'sd_flags:1:{security.SECINFO_OWNER|security.SECINFO_DACL}']
|
|
ou_sddl = (f'O:{user_sid}'
|
|
f'D:(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(f'{self.ou1},{self.base_dn}', ou_desc,
|
|
controls=ou_controls)
|
|
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'D:(A;;WP;;;{user_sid})'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_sacl(self):
|
|
'''Show that adding a computer object with a security descriptor containing a SACL is disallowed when BlockOwnerImplicitRights == 1'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(
|
|
f'{self.ou1},{self.base_dn}',
|
|
f'(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
sd_sddl = f'S:(A;;WP;;;{user_sid})'
|
|
tmp_desc = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_security_descriptor_empty(self):
|
|
'''Show that adding a computer object with an empty security descriptor is disallowed when BlockOwnerImplicitRights == 1, even when we are the owner of the OU security descriptor'''
|
|
|
|
self.assert_top_ou_deleted()
|
|
self.ldb_owner.create_ou(f'{self.ou1},{self.base_dn}')
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'1')
|
|
|
|
user_sid = self.sd_utils.get_object_sid(
|
|
self.get_user_dn(self.regular_user))
|
|
|
|
ou_controls = [
|
|
f'sd_flags:1:{security.SECINFO_OWNER|security.SECINFO_DACL}']
|
|
ou_sddl = (f'O:{user_sid}'
|
|
f'D:(OA;CI;CC;{samba.dsdb.DS_GUID_SCHEMA_CLASS_COMPUTER};;{user_sid})')
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(f'{self.ou1},{self.base_dn}', ou_desc,
|
|
controls=ou_controls)
|
|
|
|
dn = f'CN={self.test_user1},{self.ou1},{self.base_dn}'
|
|
account_name = f'{self.test_user1}$'
|
|
tmp_desc = security.descriptor.from_sddl('', self.domain_sid)
|
|
try:
|
|
self.ldb_user.add({
|
|
'dn': dn,
|
|
'objectclass': 'computer',
|
|
'sAMAccountName': account_name,
|
|
'ntSecurityDescriptor': ndr_pack(tmp_desc),
|
|
})
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
if self.strict_checking:
|
|
self.assertIn('000021CC', estr)
|
|
else:
|
|
self.fail('expected to fail')
|
|
|
|
def test_add_anonymous(self):
|
|
"""Test add operation with anonymous user"""
|
|
anonymous = SamDB(url=ldaphost, credentials=self.creds_tmp, lp=lp)
|
|
try:
|
|
anonymous.newuser("test_add_anonymous", self.user_pass)
|
|
except LdbError as e2:
|
|
(num, _) = e2.args
|
|
self.assertEqual(num, ERR_OPERATIONS_ERROR)
|
|
else:
|
|
self.fail()
|
|
|
|
# tests on ldap modify operations
|
|
|
|
|
|
class AclModifyTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclModifyTests, self).setUp()
|
|
self.user_with_wp = "acl_mod_user1"
|
|
self.user_with_sm = "acl_mod_user2"
|
|
self.user_with_group_sm = "acl_mod_user3"
|
|
self.ldb_admin.newuser(self.user_with_wp, self.user_pass)
|
|
self.ldb_admin.newuser(self.user_with_sm, self.user_pass)
|
|
self.ldb_admin.newuser(self.user_with_group_sm, self.user_pass)
|
|
self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
|
|
self.ldb_user2 = self.get_ldb_connection(self.user_with_sm, self.user_pass)
|
|
self.ldb_user3 = self.get_ldb_connection(self.user_with_group_sm, self.user_pass)
|
|
self.user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.user_with_wp))
|
|
self.ldb_admin.newgroup("test_modify_group2", grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
self.ldb_admin.newgroup("test_modify_group3", grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
self.ldb_admin.newuser("test_modify_user2", self.user_pass)
|
|
|
|
def tearDown(self):
|
|
super(AclModifyTests, self).tearDown()
|
|
delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
|
|
delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
|
|
delete_force(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
|
|
delete_force(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
|
|
delete_force(self.ldb_admin, "CN=test_mod_hostname,OU=test_modify_ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "CN=test_modify_ou1_user,OU=test_modify_ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.user_with_sm))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.user_with_group_sm))
|
|
delete_force(self.ldb_admin, self.get_user_dn("test_modify_user2"))
|
|
delete_force(self.ldb_admin, self.get_user_dn("test_anonymous"))
|
|
|
|
del self.ldb_user
|
|
del self.ldb_user2
|
|
del self.ldb_user3
|
|
|
|
def get_sd_rights_effective(self, samdb, dn):
|
|
res = samdb.search(dn,
|
|
scope=SCOPE_BASE,
|
|
attrs=['sDRightsEffective'])
|
|
sd_rights = res[0].get('sDRightsEffective', idx=0)
|
|
if sd_rights is not None:
|
|
sd_rights = int(sd_rights)
|
|
|
|
return sd_rights
|
|
|
|
def test_modify_u1(self):
|
|
"""5 Modify one attribute if you have DS_WRITE_PROPERTY for it"""
|
|
mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
|
|
# First test object -- User
|
|
print("Testing modify on User object")
|
|
self.ldb_admin.newuser("test_modify_user1", self.user_pass)
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
|
|
ldif = """
|
|
dn: """ + self.get_user_dn("test_modify_user1") + """
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % self.get_user_dn("test_modify_user1"))
|
|
self.assertEqual(str(res[0]["displayName"][0]), "test_changed")
|
|
# Second test object -- Group
|
|
print("Testing modify on Group object")
|
|
self.ldb_admin.newgroup("test_modify_group1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
self.sd_utils.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
|
|
ldif = """
|
|
dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("CN=test_modify_group1,CN=Users," + self.base_dn))
|
|
self.assertEqual(str(res[0]["displayName"][0]), "test_changed")
|
|
# Third test object -- Organizational Unit
|
|
print("Testing modify on OU object")
|
|
#delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=test_modify_ou1," + self.base_dn)
|
|
self.sd_utils.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
|
|
ldif = """
|
|
dn: OU=test_modify_ou1,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("OU=test_modify_ou1," + self.base_dn))
|
|
self.assertEqual(str(res[0]["displayName"][0]), "test_changed")
|
|
|
|
def test_modify_u2(self):
|
|
"""6 Modify two attributes as you have DS_WRITE_PROPERTY granted only for one of them"""
|
|
mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
|
|
# First test object -- User
|
|
print("Testing modify on User object")
|
|
#delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
|
|
self.ldb_admin.newuser("test_modify_user1", self.user_pass)
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
|
|
# Modify on attribute you have rights for
|
|
ldif = """
|
|
dn: """ + self.get_user_dn("test_modify_user1") + """
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" %
|
|
self.get_user_dn("test_modify_user1"))
|
|
self.assertEqual(str(res[0]["displayName"][0]), "test_changed")
|
|
# Modify on attribute you do not have rights for granted
|
|
ldif = """
|
|
dn: """ + self.get_user_dn("test_modify_user1") + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e3:
|
|
(num, _) = e3.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
# Second test object -- Group
|
|
print("Testing modify on Group object")
|
|
self.ldb_admin.newgroup("test_modify_group1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
self.sd_utils.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
|
|
ldif = """
|
|
dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" %
|
|
str("CN=test_modify_group1,CN=Users," + self.base_dn))
|
|
self.assertEqual(str(res[0]["displayName"][0]), "test_changed")
|
|
# Modify on attribute you do not have rights for granted
|
|
ldif = """
|
|
dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e4:
|
|
(num, _) = e4.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
# Modify on attribute you do not have rights for granted while also modifying something you do have rights for
|
|
ldif = """
|
|
dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e5:
|
|
(num, _) = e5.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
# Second test object -- Organizational Unit
|
|
print("Testing modify on OU object")
|
|
self.ldb_admin.create_ou("OU=test_modify_ou1," + self.base_dn)
|
|
self.sd_utils.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
|
|
ldif = """
|
|
dn: OU=test_modify_ou1,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: test_changed"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % str("OU=test_modify_ou1,"
|
|
+ self.base_dn))
|
|
self.assertEqual(str(res[0]["displayName"][0]), "test_changed")
|
|
# Modify on attribute you do not have rights for granted
|
|
ldif = """
|
|
dn: OU=test_modify_ou1,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e6:
|
|
(num, _) = e6.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
|
|
def test_modify_u3(self):
|
|
"""7 Modify one attribute as you have no what so ever rights granted"""
|
|
# First test object -- User
|
|
print("Testing modify on User object")
|
|
self.ldb_admin.newuser("test_modify_user1", self.user_pass)
|
|
# Modify on attribute you do not have rights for granted
|
|
ldif = """
|
|
dn: """ + self.get_user_dn("test_modify_user1") + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e7:
|
|
(num, _) = e7.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
|
|
# Second test object -- Group
|
|
print("Testing modify on Group object")
|
|
self.ldb_admin.newgroup("test_modify_group1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
# Modify on attribute you do not have rights for granted
|
|
ldif = """
|
|
dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e8:
|
|
(num, _) = e8.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
|
|
# Second test object -- Organizational Unit
|
|
print("Testing modify on OU object")
|
|
#delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=test_modify_ou1," + self.base_dn)
|
|
# Modify on attribute you do not have rights for granted
|
|
ldif = """
|
|
dn: OU=test_modify_ou1,""" + self.base_dn + """
|
|
changetype: modify
|
|
replace: url
|
|
url: www.samba.org"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e9:
|
|
(num, _) = e9.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
|
|
def test_modify_u4(self):
|
|
"""11 Grant WP to PRINCIPAL_SELF and test modify"""
|
|
ldif = """
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
add: adminDescription
|
|
adminDescription: blah blah blah"""
|
|
try:
|
|
self.ldb_user.modify_ldif(ldif)
|
|
except LdbError as e10:
|
|
(num, _) = e10.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
|
|
mod = "(OA;;WP;bf967919-0de6-11d0-a285-00aa003049e2;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
# Modify on attribute you have rights for
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)"
|
|
% self.get_user_dn(self.user_with_wp), attrs=["adminDescription"])
|
|
self.assertEqual(str(res[0]["adminDescription"][0]), "blah blah blah")
|
|
|
|
def test_modify_u5(self):
|
|
"""12 test self membership"""
|
|
ldif = """
|
|
dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
add: Member
|
|
Member: """ + self.get_user_dn(self.user_with_sm)
|
|
# the user has no rights granted, this should fail
|
|
try:
|
|
self.ldb_user2.modify_ldif(ldif)
|
|
except LdbError as e11:
|
|
(num, _) = e11.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
|
|
# grant self-membership, should be able to add himself
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.user_with_sm))
|
|
mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
|
|
self.ldb_user2.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)"
|
|
% ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
|
|
self.assertEqual(str(res[0]["Member"][0]), self.get_user_dn(self.user_with_sm))
|
|
# but not other users
|
|
ldif = """
|
|
dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
add: Member
|
|
Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
|
|
try:
|
|
self.ldb_user2.modify_ldif(ldif)
|
|
except LdbError as e12:
|
|
(num, _) = e12.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_u6(self):
|
|
"""13 test self membership"""
|
|
ldif = """
|
|
dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
add: Member
|
|
Member: """ + self.get_user_dn(self.user_with_sm) + """
|
|
Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
|
|
|
|
# grant self-membership, should be able to add himself but not others at the same time
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.user_with_sm))
|
|
mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
|
|
try:
|
|
self.ldb_user2.modify_ldif(ldif)
|
|
except LdbError as e13:
|
|
(num, _) = e13.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_u7(self):
|
|
"""13 User with WP modifying Member"""
|
|
# a second user is given write property permission
|
|
user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.user_with_wp))
|
|
mod = "(A;;WP;;;%s)" % str(user_sid)
|
|
self.sd_utils.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
|
|
ldif = """
|
|
dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
add: Member
|
|
Member: """ + self.get_user_dn(self.user_with_wp)
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)"
|
|
% ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
|
|
self.assertEqual(str(res[0]["Member"][0]), self.get_user_dn(self.user_with_wp))
|
|
ldif = """
|
|
dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
delete: Member"""
|
|
self.ldb_user.modify_ldif(ldif)
|
|
ldif = """
|
|
dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
|
|
changetype: modify
|
|
add: Member
|
|
Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
|
|
self.ldb_user.modify_ldif(ldif)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)"
|
|
% ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
|
|
self.assertEqual(str(res[0]["Member"][0]), "CN=test_modify_user2,CN=Users," + self.base_dn)
|
|
|
|
def test_modify_dacl_explicit_user(self):
|
|
'''Modify the DACL of a user's security descriptor when we have RIGHT_WRITE_DAC'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'D:(A;;WP;;;BA)'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
new_sddl = f'D:(A;;WP;;;{self.user_sid})'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
controls = [f'sd_flags:1:{security.SECINFO_DACL}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the DACL.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we don't have WRITE_DAC.
|
|
try:
|
|
self.ldb_user.modify(message, controls=controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Grant ourselves WRITE_DAC.
|
|
write_dac_sddl = f'(A;CI;WD;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, write_dac_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_DACL
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=controls)
|
|
|
|
def test_modify_dacl_explicit_computer(self):
|
|
'''Modify the DACL of a computer's security descriptor when we have RIGHT_WRITE_DAC'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'D:(A;;WP;;;BA)'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
new_sddl = f'D:(A;;WP;;;{self.user_sid})'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
controls = [f'sd_flags:1:{security.SECINFO_DACL}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the DACL.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we don't have WRITE_DAC.
|
|
try:
|
|
self.ldb_user.modify(message, controls=controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Grant ourselves WRITE_DAC.
|
|
write_dac_sddl = f'(A;CI;WD;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, write_dac_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=controls)
|
|
|
|
def test_modify_dacl_owner_user(self):
|
|
'''Modify the DACL of a user's security descriptor when we are its owner'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
new_sddl = f'D:(A;;WP;;;{self.user_sid})'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
dacl_controls = [f'sd_flags:1:{security.SECINFO_DACL}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the DACL.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we are not the owner.
|
|
try:
|
|
self.ldb_user.modify(message, controls=dacl_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Make ourselves the owner of the security descriptor.
|
|
owner_sddl = f'O:{self.user_sid}'
|
|
owner_desc = security.descriptor.from_sddl(owner_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(user_dn, owner_desc,
|
|
controls=owner_controls)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_DACL
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=dacl_controls)
|
|
|
|
def test_modify_dacl_owner_computer_implicit_right_blocked(self):
|
|
'''Show that we cannot modify the DACL of a computer's security descriptor when we are its owner and BlockOwnerImplicitRights == 1'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
new_sddl = f'D:(A;;WP;;;{self.user_sid})'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
dacl_controls = [f'sd_flags:1:{security.SECINFO_DACL}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the DACL.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we are not the owner.
|
|
try:
|
|
self.ldb_user.modify(message, controls=dacl_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Make ourselves the owner of the security descriptor.
|
|
owner_sddl = f'O:{self.user_sid}'
|
|
owner_desc = security.descriptor.from_sddl(owner_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(dn, owner_desc,
|
|
controls=owner_controls)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails even when specifying the controls.
|
|
try:
|
|
self.ldb_user.modify(message, controls=dacl_controls)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dacl_owner_computer_implicit_right_allowed(self):
|
|
'''Modify the DACL of a computer's security descriptor when we are its owner and BlockOwnerImplicitRights != 1'''
|
|
|
|
self.set_heuristic(samba.dsdb.DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS, b'0')
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
new_sddl = f'D:(A;;WP;;;{self.user_sid})'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
dacl_controls = [f'sd_flags:1:{security.SECINFO_DACL}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the DACL.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we are not the owner.
|
|
try:
|
|
self.ldb_user.modify(message, controls=dacl_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Make ourselves the owner of the security descriptor.
|
|
owner_sddl = f'O:{self.user_sid}'
|
|
owner_desc = security.descriptor.from_sddl(owner_sddl, self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(dn, owner_desc,
|
|
controls=owner_controls)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=dacl_controls)
|
|
|
|
def test_modify_owner_explicit_user(self):
|
|
'''Modify the owner of a user's security descriptor when we have RIGHT_WRITE_OWNER'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
# Try to modify the owner to ourselves.
|
|
new_sddl = f'O:{self.user_sid}'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we don't have WRITE_OWNER.
|
|
try:
|
|
self.ldb_user.modify(message, controls=owner_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_OWNER | security.SECINFO_GROUP
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=owner_controls)
|
|
|
|
def test_modify_owner_explicit_computer(self):
|
|
'''Modify the owner of a computer's security descriptor when we have RIGHT_WRITE_OWNER'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
# Try to modify the owner to ourselves.
|
|
new_sddl = f'O:{self.user_sid}'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we don't have WRITE_OWNER.
|
|
try:
|
|
self.ldb_user.modify(message, controls=owner_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=owner_controls)
|
|
|
|
def test_modify_group_explicit_user(self):
|
|
'''Modify the group of a user's security descriptor when we have RIGHT_WRITE_OWNER'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
# Try to modify the group to ourselves.
|
|
new_sddl = f'G:{self.user_sid}'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
group_controls = [f'sd_flags:1:{security.SECINFO_GROUP}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the group.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we don't have WRITE_OWNER.
|
|
try:
|
|
self.ldb_user.modify(message, controls=group_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_OWNER | security.SECINFO_GROUP
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=group_controls)
|
|
|
|
def test_modify_group_explicit_computer(self):
|
|
'''Modify the group of a computer's security descriptor when we have RIGHT_WRITE_OWNER'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
# Try to modify the group to ourselves.
|
|
new_sddl = f'G:{self.user_sid}'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
group_controls = [f'sd_flags:1:{security.SECINFO_GROUP}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the group.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# The update fails since we don't have WRITE_OWNER.
|
|
try:
|
|
self.ldb_user.modify(message, controls=group_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails if we don't specify the controls.
|
|
try:
|
|
self.ldb_user.modify(message)
|
|
except LdbError as err:
|
|
if self.strict_checking:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
self.assertIn(f'{werror.WERR_ACCESS_DENIED:08X}', estr)
|
|
else:
|
|
self.fail()
|
|
|
|
# The update succeeds when specifying the controls.
|
|
self.ldb_user.modify(message, controls=group_controls)
|
|
|
|
def test_modify_owner_other_user(self):
|
|
'''Show we cannot set the owner of a user's security descriptor to another SID'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
# Try to modify the owner to someone other than ourselves.
|
|
new_sddl = f'O:BA'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_OWNER | security.SECINFO_GROUP
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails when trying to specify another user.
|
|
try:
|
|
self.ldb_user.modify(message, controls=owner_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_INVALID_OWNER:08X}', estr)
|
|
else:
|
|
self.fail('expected an error')
|
|
|
|
def test_modify_owner_other_computer(self):
|
|
'''Show we cannot set the owner of a computer's security descriptor to another SID'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
# Try to modify the owner to someone other than ourselves.
|
|
new_sddl = f'O:BA'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update fails when trying to specify another user.
|
|
try:
|
|
self.ldb_user.modify(message, controls=owner_controls)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
if self.strict_checking:
|
|
self.assertIn(f'{werror.WERR_INVALID_OWNER:08X}', estr)
|
|
else:
|
|
self.fail('expected an error')
|
|
|
|
def test_modify_owner_other_admin_user(self):
|
|
'''Show a domain admin cannot set the owner of a user's security descriptor to another SID'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
# Try to modify the owner to someone other than ourselves.
|
|
new_sddl = f'O:BA'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_OWNER | security.SECINFO_GROUP
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update succeeds as admin when trying to specify another user.
|
|
self.ldb_admin.modify(message, controls=owner_controls)
|
|
|
|
def test_modify_owner_other_admin_computer(self):
|
|
'''Show a domain admin cannot set the owner of a computer's security descriptor to another SID'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
# Try to modify the owner to someone other than ourselves.
|
|
new_sddl = f'O:BA'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update succeeds as admin when trying to specify another user.
|
|
self.ldb_admin.modify(message, controls=owner_controls)
|
|
|
|
def test_modify_owner_admin_user(self):
|
|
'''Show a domain admin can set the owner of a user's security descriptor to Domain Admins'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
username = 'test_modify_ou1_user'
|
|
user_dn = Dn(self.ldb_admin, f'CN={username},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
self.ldb_admin.newuser(username, self.user_pass,
|
|
userou=f'OU={ou_name}',
|
|
sd=descriptor)
|
|
|
|
# Try to modify the owner to Domain Admins.
|
|
new_sddl = f'O:DA'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = 0
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(user_dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, user_dn)
|
|
expected_rights = security.SECINFO_OWNER | security.SECINFO_GROUP
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update succeeds as admin when specifying Domain Admins.
|
|
self.ldb_admin.modify(message, controls=owner_controls)
|
|
|
|
def test_modify_owner_admin_computer(self):
|
|
'''Show a domain admin can set the owner of a computer's security descriptor to Domain Admins'''
|
|
|
|
ou_name = 'test_modify_ou1'
|
|
ou_dn = f'OU={ou_name},{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = Dn(self.ldb_admin, f'CN={account_name},{ou_dn}')
|
|
|
|
sd_sddl = 'O:BA'
|
|
descriptor = security.descriptor.from_sddl(sd_sddl, self.domain_sid)
|
|
|
|
ou_sddl = f'D:(OA;CI;WP;{samba.dsdb.DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR};;{self.user_sid})'
|
|
ou_desc = security.descriptor.from_sddl(ou_sddl, self.domain_sid)
|
|
self.ldb_admin.create_ou(ou_dn, name=ou_name, sd=ou_desc)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'nTSecurityDescriptor': ndr_pack(descriptor),
|
|
})
|
|
|
|
# Try to modify the owner to Domain Admins.
|
|
new_sddl = f'O:DA'
|
|
new_desc = security.descriptor.from_sddl(new_sddl, self.domain_sid)
|
|
|
|
owner_controls = [f'sd_flags:1:{security.SECINFO_OWNER}']
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The user should not be able to modify the owner.
|
|
message = Message(dn)
|
|
message['nTSecurityDescriptor'] = MessageElement(
|
|
ndr_pack(new_desc),
|
|
FLAG_MOD_REPLACE,
|
|
'nTSecurityDescriptor')
|
|
|
|
# Grant ourselves WRITE_OWNER.
|
|
owner_sddl = f'(A;CI;WO;;;{self.user_sid})'
|
|
self.sd_utils.dacl_add_ace(ou_dn, owner_sddl)
|
|
|
|
# Check our effective rights.
|
|
effective_rights = self.get_sd_rights_effective(self.ldb_user, dn)
|
|
expected_rights = None
|
|
self.assertEqual(expected_rights, effective_rights)
|
|
|
|
# The update succeeds as admin when specifying Domain Admins.
|
|
self.ldb_admin.modify(message, controls=owner_controls)
|
|
|
|
def test_modify_anonymous(self):
|
|
"""Test add operation with anonymous user"""
|
|
anonymous = SamDB(url=ldaphost, credentials=self.creds_tmp, lp=lp)
|
|
self.ldb_admin.newuser("test_anonymous", "samba123@")
|
|
m = Message()
|
|
m.dn = Dn(anonymous, self.get_user_dn("test_anonymous"))
|
|
|
|
m["description"] = MessageElement("sambauser2",
|
|
FLAG_MOD_ADD,
|
|
"description")
|
|
try:
|
|
anonymous.modify(m)
|
|
except LdbError as e14:
|
|
(num, _) = e14.args
|
|
self.assertEqual(num, ERR_OPERATIONS_ERROR)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name(self):
|
|
'''Test modifying dNSHostName with validated write'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_no_validated_write(self):
|
|
'''Test modifying dNSHostName without validated write'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_invalid(self):
|
|
'''Test modifying dNSHostName to an invalid value'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = 'invalid'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_invalid_wp(self):
|
|
'''Test modifying dNSHostName to an invalid value when we have WP'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Write Property.
|
|
mod = (f'(OA;CI;WP;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = 'invalid'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_invalid_non_computer(self):
|
|
'''Test modifying dNSHostName to an invalid value on a non-computer'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'user',
|
|
'sAMAccountName': f'{account_name}',
|
|
})
|
|
|
|
host_name = 'invalid'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_INSUFFICIENT_ACCESS_RIGHTS, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_no_value(self):
|
|
'''Test modifying dNSHostName with validated write with no value'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement([],
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_OPERATIONS_ERROR, num)
|
|
else:
|
|
# Windows accepts this.
|
|
pass
|
|
|
|
def test_modify_dns_host_name_empty_string(self):
|
|
'''Test modifying dNSHostName with validated write of an empty string'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement('\0',
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_dollar(self):
|
|
'''Test modifying dNSHostName with validated write of a value including a dollar'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}$.{self.ldb_user.domain_dns_name()}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_account_no_dollar(self):
|
|
'''Test modifying dNSHostName with validated write with no dollar in sAMAccountName'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}',
|
|
})
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_no_suffix(self):
|
|
'''Test modifying dNSHostName with validated write of a value missing the suffix'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_wrong_prefix(self):
|
|
'''Test modifying dNSHostName with validated write of a value with the wrong prefix'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'invalid.{self.ldb_user.domain_dns_name()}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_wrong_suffix(self):
|
|
'''Test modifying dNSHostName with validated write of a value with the wrong suffix'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}.invalid.example.com'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_case(self):
|
|
'''Test modifying dNSHostName with validated write of a value with irregular case'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
host_name = host_name.capitalize()
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_allowed_suffixes(self):
|
|
'''Test modifying dNSHostName with validated write and an allowed suffix'''
|
|
|
|
allowed_suffix = 'suffix.that.is.allowed'
|
|
|
|
# Add the allowed suffix.
|
|
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
scope=SCOPE_BASE,
|
|
attrs=['msDS-AllowedDNSSuffixes'])
|
|
self.assertEqual(1, len(res))
|
|
old_allowed_suffixes = res[0].get('msDS-AllowedDNSSuffixes')
|
|
|
|
def modify_allowed_suffixes(suffixes):
|
|
if suffixes is None:
|
|
suffixes = []
|
|
flag = FLAG_MOD_DELETE
|
|
else:
|
|
flag = FLAG_MOD_REPLACE
|
|
|
|
m = Message(Dn(self.ldb_admin, self.base_dn))
|
|
m['msDS-AllowedDNSSuffixes'] = MessageElement(
|
|
suffixes,
|
|
flag,
|
|
'msDS-AllowedDNSSuffixes')
|
|
self.ldb_admin.modify(m)
|
|
|
|
self.addCleanup(modify_allowed_suffixes, old_allowed_suffixes)
|
|
|
|
if old_allowed_suffixes is None:
|
|
allowed_suffixes = []
|
|
else:
|
|
allowed_suffixes = list(old_allowed_suffixes)
|
|
|
|
if (allowed_suffix not in allowed_suffixes and
|
|
allowed_suffix.encode('utf-8') not in allowed_suffixes):
|
|
allowed_suffixes.append(allowed_suffix)
|
|
|
|
modify_allowed_suffixes(allowed_suffixes)
|
|
|
|
# Create the account and run the test.
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}.{allowed_suffix}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['dNSHostName'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_spn(self):
|
|
'''Test modifying dNSHostName and SPN with validated write'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_VALIDATE_SPN};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
spn = f'host/{host_name}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['0'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
m['1'] = MessageElement(spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_spn_matching_dns_host_name_invalid(self):
|
|
'''Test modifying SPN with validated write, matching a valid dNSHostName '''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Write Property.
|
|
mod = (f'(OA;CI;WP;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_VALIDATE_SPN};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
invalid_host_name = 'invalid'
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
spn = f'host/{host_name}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['0'] = MessageElement(invalid_host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
m['1'] = MessageElement(spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
m['2'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
def test_modify_spn_matching_dns_host_name_original(self):
|
|
'''Test modifying SPN with validated write, matching the original dNSHostName '''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_VALIDATE_SPN};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
original_host_name = 'invalid_host_name'
|
|
original_spn = 'host/{original_host_name}'
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
'dNSHostName': original_host_name,
|
|
})
|
|
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['0'] = MessageElement(original_spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
m['1'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_spn_matching_account_name_original(self):
|
|
'''Test modifying dNSHostName and SPN with validated write, matching the original sAMAccountName'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
sam_account_name = '3e0abfd0-126a-11d0-a060-00aa006c33ed'
|
|
|
|
# Grant Write Property.
|
|
mod = (f'(OA;CI;WP;{sam_account_name};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_VALIDATE_SPN};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
new_account_name = 'test_mod_hostname2'
|
|
host_name = f'{account_name}.{self.ldb_user.domain_dns_name()}'
|
|
spn = f'host/{host_name}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['0'] = MessageElement(host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
m['1'] = MessageElement(spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
m['2'] = MessageElement(f'{new_account_name}$',
|
|
FLAG_MOD_REPLACE,
|
|
'sAMAccountName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError as err:
|
|
num, estr = err.args
|
|
self.assertEqual(ERR_CONSTRAINT_VIOLATION, num)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_modify_dns_host_name_spn_matching_account_name_new(self):
|
|
'''Test modifying dNSHostName and SPN with validated write, matching the new sAMAccountName'''
|
|
|
|
ou_dn = f'OU=test_modify_ou1,{self.base_dn}'
|
|
|
|
account_name = 'test_mod_hostname'
|
|
dn = f'CN={account_name},{ou_dn}'
|
|
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
|
|
sam_account_name = '3e0abfd0-126a-11d0-a060-00aa006c33ed'
|
|
|
|
# Grant Write Property.
|
|
mod = (f'(OA;CI;WP;{sam_account_name};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
# Grant Validated Write.
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_DNS_HOST_NAME};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
mod = (f'(OA;CI;SW;{security.GUID_DRS_VALIDATE_SPN};;'
|
|
f'{self.user_sid})')
|
|
self.sd_utils.dacl_add_ace(ou_dn, mod)
|
|
|
|
# Create the account.
|
|
self.ldb_admin.add({
|
|
'dn': dn,
|
|
'objectClass': 'computer',
|
|
'sAMAccountName': f'{account_name}$',
|
|
})
|
|
|
|
new_account_name = 'test_mod_hostname2'
|
|
new_host_name = f'{new_account_name}.{self.ldb_user.domain_dns_name()}'
|
|
new_spn = f'host/{new_host_name}'
|
|
|
|
m = Message(Dn(self.ldb_user, dn))
|
|
m['0'] = MessageElement(new_spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
m['1'] = MessageElement(new_host_name,
|
|
FLAG_MOD_REPLACE,
|
|
'dNSHostName')
|
|
m['2'] = MessageElement(f'{new_account_name}$',
|
|
FLAG_MOD_REPLACE,
|
|
'sAMAccountName')
|
|
try:
|
|
self.ldb_user.modify(m)
|
|
except LdbError:
|
|
self.fail()
|
|
|
|
# enable these when we have search implemented
|
|
|
|
|
|
class AclSearchTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclSearchTests, self).setUp()
|
|
|
|
# permit password changes during this test
|
|
PasswordCommon.allow_password_changes(self, self.ldb_admin)
|
|
|
|
self.u1 = "search_u1"
|
|
self.u2 = "search_u2"
|
|
self.u3 = "search_u3"
|
|
self.group1 = "group1"
|
|
self.ldb_admin.newuser(self.u1, self.user_pass)
|
|
self.ldb_admin.newuser(self.u2, self.user_pass)
|
|
self.ldb_admin.newuser(self.u3, self.user_pass)
|
|
self.ldb_admin.newgroup(self.group1, grouptype=samba.dsdb.GTYPE_SECURITY_GLOBAL_GROUP)
|
|
self.ldb_admin.add_remove_group_members(self.group1, [self.u2],
|
|
add_members_operation=True)
|
|
self.ldb_user = self.get_ldb_connection(self.u1, self.user_pass)
|
|
self.ldb_user2 = self.get_ldb_connection(self.u2, self.user_pass)
|
|
self.ldb_user3 = self.get_ldb_connection(self.u3, self.user_pass)
|
|
self.full_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
|
|
self.user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.u1))
|
|
self.group_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.group1))
|
|
|
|
def create_clean_ou(self, object_dn):
|
|
""" Base repeating setup for unittests to follow """
|
|
res = self.ldb_admin.search(base=self.base_dn, scope=SCOPE_SUBTREE,
|
|
expression="distinguishedName=%s" % object_dn)
|
|
# Make sure top testing OU has been deleted before starting the test
|
|
self.assertEqual(len(res), 0)
|
|
self.ldb_admin.create_ou(object_dn)
|
|
desc_sddl = self.sd_utils.get_sd_as_sddl(object_dn)
|
|
# Make sure there are inheritable ACEs initially
|
|
self.assertTrue("CI" in desc_sddl or "OI" in desc_sddl)
|
|
# Find and remove all inherit ACEs
|
|
res = re.findall(r"\(.*?\)", desc_sddl)
|
|
res = [x for x in res if ("CI" in x) or ("OI" in x)]
|
|
for x in res:
|
|
desc_sddl = desc_sddl.replace(x, "")
|
|
# Add flag 'protected' in both DACL and SACL so no inherit ACEs
|
|
# can propagate from above
|
|
# remove SACL, we are not interested
|
|
desc_sddl = desc_sddl.replace(":AI", ":AIP")
|
|
self.sd_utils.modify_sd_on_dn(object_dn, desc_sddl)
|
|
# Verify all inheritable ACEs are gone
|
|
desc_sddl = self.sd_utils.get_sd_as_sddl(object_dn)
|
|
self.assertNotIn("CI", desc_sddl)
|
|
self.assertNotIn("OI", desc_sddl)
|
|
|
|
def tearDown(self):
|
|
super(AclSearchTests, self).tearDown()
|
|
delete_force(self.ldb_admin, "OU=test_search_ou2,OU=test_search_ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "OU=ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, self.get_user_dn("search_u1"))
|
|
delete_force(self.ldb_admin, self.get_user_dn("search_u2"))
|
|
delete_force(self.ldb_admin, self.get_user_dn("search_u3"))
|
|
delete_force(self.ldb_admin, self.get_user_dn("group1"))
|
|
|
|
del self.ldb_user
|
|
del self.ldb_user2
|
|
del self.ldb_user3
|
|
|
|
def test_search_anonymous1(self):
|
|
"""Verify access of rootDSE with the correct request"""
|
|
anonymous = SamDB(url=ldaphost, credentials=self.creds_tmp, lp=lp)
|
|
res = anonymous.search("", expression="(objectClass=*)", scope=SCOPE_BASE)
|
|
self.assertEqual(len(res), 1)
|
|
# verify some of the attributes
|
|
# don't care about values
|
|
self.assertIn("ldapServiceName", res[0])
|
|
self.assertIn("namingContexts", res[0])
|
|
self.assertIn("isSynchronized", res[0])
|
|
self.assertIn("dsServiceName", res[0])
|
|
self.assertIn("supportedSASLMechanisms", res[0])
|
|
self.assertIn("isGlobalCatalogReady", res[0])
|
|
self.assertIn("domainControllerFunctionality", res[0])
|
|
self.assertIn("serverName", res[0])
|
|
|
|
def test_search_anonymous2(self):
|
|
"""Make sure we cannot access anything else"""
|
|
anonymous = SamDB(url=ldaphost, credentials=self.creds_tmp, lp=lp)
|
|
try:
|
|
anonymous.search("", expression="(objectClass=*)", scope=SCOPE_SUBTREE)
|
|
except LdbError as e15:
|
|
(num, _) = e15.args
|
|
self.assertEqual(num, ERR_OPERATIONS_ERROR)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
anonymous.search(self.base_dn, expression="(objectClass=*)", scope=SCOPE_SUBTREE)
|
|
except LdbError as e16:
|
|
(num, _) = e16.args
|
|
self.assertEqual(num, ERR_OPERATIONS_ERROR)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
anonymous.search(anonymous.get_config_basedn(), expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
except LdbError as e17:
|
|
(num, _) = e17.args
|
|
self.assertEqual(num, ERR_OPERATIONS_ERROR)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_search_anonymous3(self):
|
|
"""Set dsHeuristics and repeat"""
|
|
self.ldb_admin.set_dsheuristics("0000002")
|
|
self.ldb_admin.create_ou("OU=test_search_ou1," + self.base_dn)
|
|
mod = "(A;CI;LC;;;AN)"
|
|
self.sd_utils.dacl_add_ace("OU=test_search_ou1," + self.base_dn, mod)
|
|
self.ldb_admin.create_ou("OU=test_search_ou2,OU=test_search_ou1," + self.base_dn)
|
|
anonymous = SamDB(url=ldaphost, credentials=self.creds_tmp, lp=lp)
|
|
res = anonymous.search("OU=test_search_ou2,OU=test_search_ou1," + self.base_dn,
|
|
expression="(objectClass=*)", scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 1)
|
|
self.assertIn("dn", res[0])
|
|
self.assertEqual(res[0]["dn"], Dn(self.ldb_admin,
|
|
"OU=test_search_ou2,OU=test_search_ou1," + self.base_dn))
|
|
res = anonymous.search(anonymous.get_config_basedn(), expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 1)
|
|
self.assertIn("dn", res[0])
|
|
self.assertEqual(res[0]["dn"], Dn(self.ldb_admin, self.configuration_dn))
|
|
|
|
def test_search1(self):
|
|
"""Make sure users can see us if given LC to user and group"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
mod = "(A;;LC;;;%s)(A;;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
tmp_desc = security.descriptor.from_sddl("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod,
|
|
self.domain_sid)
|
|
self.ldb_admin.create_ou("OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou4,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
|
|
# regular users must see only ou1 and ou2
|
|
res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 2)
|
|
ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou1," + self.base_dn)]
|
|
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
# these users should see all ous
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 6)
|
|
res_list = [x["dn"] for x in res if x["dn"] in self.full_list]
|
|
self.assertEqual(sorted(res_list), sorted(self.full_list))
|
|
|
|
res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 6)
|
|
res_list = [x["dn"] for x in res if x["dn"] in self.full_list]
|
|
self.assertEqual(sorted(res_list), sorted(self.full_list))
|
|
|
|
def test_search2(self):
|
|
"""Make sure users can't see us if access is explicitly denied"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=ou2,OU=ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
|
|
self.ldb_admin.create_ou("OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
|
|
mod = "(D;;LC;;;%s)(D;;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
|
|
res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
# this user should see all ous
|
|
res_list = [x["dn"] for x in res if x["dn"] in self.full_list]
|
|
self.assertEqual(sorted(res_list), sorted(self.full_list))
|
|
|
|
# these users should see ou1, 2, 5 and 6 but not 3 and 4
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 4)
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
def test_search3(self):
|
|
"""Make sure users can't see ous if access is explicitly denied - 2"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
mod = "(A;CI;LC;;;%s)(A;CI;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
tmp_desc = security.descriptor.from_sddl("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod,
|
|
self.domain_sid)
|
|
self.ldb_admin.create_ou("OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou4,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
|
|
print("Testing correct behavior on nonaccessible search base")
|
|
try:
|
|
self.ldb_user3.search("OU=ou3,OU=ou2,OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_BASE)
|
|
except LdbError as e18:
|
|
(num, _) = e18.args
|
|
self.assertEqual(num, ERR_NO_SUCH_OBJECT)
|
|
else:
|
|
self.fail()
|
|
|
|
mod = "(D;;LC;;;%s)(D;;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
|
|
|
|
ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou1," + self.base_dn)]
|
|
|
|
res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
|
|
|
|
# should not see ou3 and ou4, but should see ou5 and ou6
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 4)
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 4)
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
def test_search4(self):
|
|
"""There is no difference in visibility if the user is also creator"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
mod = "(A;CI;CCWD;;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
tmp_desc = security.descriptor.from_sddl("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod,
|
|
self.domain_sid)
|
|
self.ldb_user.create_ou("OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_user.create_ou("OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_user.create_ou("OU=ou4,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_user.create_ou("OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_user.create_ou("OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
|
|
ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
|
|
Dn(self.ldb_admin, "OU=ou1," + self.base_dn)]
|
|
res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 2)
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 2)
|
|
res_list = [x["dn"] for x in res if x["dn"] in ok_list]
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
def test_search5(self):
|
|
"""Make sure users can see only attributes they are allowed to see"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
mod = "(A;CI;LC;;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
tmp_desc = security.descriptor.from_sddl("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod,
|
|
self.domain_sid)
|
|
self.ldb_admin.create_ou("OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
# assert user can only see dn
|
|
res = self.ldb_user.search("OU=ou2,OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
ok_list = ['dn']
|
|
self.assertEqual(len(res), 1)
|
|
res_list = list(res[0].keys())
|
|
self.assertEqual(res_list, ok_list)
|
|
|
|
res = self.ldb_user.search("OU=ou2,OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_BASE, attrs=["ou"])
|
|
|
|
self.assertEqual(len(res), 1)
|
|
res_list = list(res[0].keys())
|
|
self.assertEqual(res_list, ok_list)
|
|
|
|
# give read property on ou and assert user can only see dn and ou
|
|
mod = "(OA;;RP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
self.sd_utils.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
|
|
res = self.ldb_user.search("OU=ou2,OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
ok_list = ['dn', 'ou']
|
|
self.assertEqual(len(res), 1)
|
|
res_list = list(res[0].keys())
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
# give read property on Public Information and assert user can see ou and other members
|
|
mod = "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
self.sd_utils.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
|
|
res = self.ldb_user.search("OU=ou2,OU=ou1," + self.base_dn, expression="(objectClass=*)",
|
|
scope=SCOPE_SUBTREE)
|
|
|
|
ok_list = ['dn', 'objectClass', 'ou', 'distinguishedName', 'name', 'objectGUID', 'objectCategory']
|
|
res_list = list(res[0].keys())
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
def test_search6(self):
|
|
"""If an attribute that cannot be read is used in a filter, it is as if the attribute does not exist"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
mod = "(A;CI;LCCCWD;;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
tmp_desc = security.descriptor.from_sddl("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod,
|
|
self.domain_sid)
|
|
self.ldb_admin.create_ou("OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_user.create_ou("OU=ou3,OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(ou=ou3)",
|
|
scope=SCOPE_SUBTREE)
|
|
# nothing should be returned as ou is not accessible
|
|
self.assertEqual(len(res), 0)
|
|
|
|
# give read property on ou and assert user can only see dn and ou
|
|
mod = "(OA;;RP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou3,OU=ou2,OU=ou1," + self.base_dn, mod)
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(ou=ou3)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 1)
|
|
ok_list = ['dn', 'ou']
|
|
res_list = list(res[0].keys())
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
# give read property on Public Information and assert user can see ou and other members
|
|
mod = "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;%s)" % (str(self.user_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
|
|
res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(ou=ou2)",
|
|
scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), 1)
|
|
ok_list = ['dn', 'objectClass', 'ou', 'distinguishedName', 'name', 'objectGUID', 'objectCategory']
|
|
res_list = list(res[0].keys())
|
|
self.assertEqual(sorted(res_list), sorted(ok_list))
|
|
|
|
def assert_search_on_attr(self, dn, samdb, attr, expected_list):
|
|
|
|
expected_num = len(expected_list)
|
|
res = samdb.search(dn, expression="(%s=*)" % attr, scope=SCOPE_SUBTREE)
|
|
self.assertEqual(len(res), expected_num)
|
|
|
|
res_list = [ x["dn"] for x in res if x["dn"] in expected_list ]
|
|
self.assertEqual(sorted(res_list), sorted(expected_list))
|
|
|
|
def test_search7(self):
|
|
"""Checks object search visibility when users don't have full rights"""
|
|
self.create_clean_ou("OU=ou1," + self.base_dn)
|
|
mod = "(A;;LC;;;%s)(A;;LC;;;%s)" % (str(self.user_sid),
|
|
str(self.group_sid))
|
|
self.sd_utils.dacl_add_ace("OU=ou1," + self.base_dn, mod)
|
|
tmp_desc = security.descriptor.from_sddl("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod,
|
|
self.domain_sid)
|
|
self.ldb_admin.create_ou("OU=ou2,OU=ou1," + self.base_dn, sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
|
|
sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
|
|
sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
|
|
sd=tmp_desc)
|
|
self.ldb_admin.create_ou("OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
|
|
sd=tmp_desc)
|
|
|
|
ou2_dn = Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn)
|
|
ou1_dn = Dn(self.ldb_admin, "OU=ou1," + self.base_dn)
|
|
|
|
# even though unprivileged users can't read these attributes for OU2,
|
|
# the object should still be visible in searches, because they have
|
|
# 'List Contents' rights still. This isn't really disclosive because
|
|
# ALL objects have these attributes
|
|
visible_attrs = ["objectClass", "distinguishedName", "name",
|
|
"objectGUID"]
|
|
two_objects = [ou2_dn, ou1_dn]
|
|
|
|
for attr in visible_attrs:
|
|
# a regular user should just see the 2 objects
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_user3, attr,
|
|
expected_list=two_objects)
|
|
|
|
# whereas the following users have LC rights for all the objects,
|
|
# so they should see them all
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_user, attr,
|
|
expected_list=self.full_list)
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_user2, attr,
|
|
expected_list=self.full_list)
|
|
|
|
# however when searching on the following attributes, objects will not
|
|
# be visible unless the user has Read Property rights
|
|
hidden_attrs = ["objectCategory", "instanceType", "ou", "uSNChanged",
|
|
"uSNCreated", "whenCreated"]
|
|
one_object = [ou1_dn]
|
|
|
|
for attr in hidden_attrs:
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_user3, attr,
|
|
expected_list=one_object)
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_user, attr,
|
|
expected_list=one_object)
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_user2, attr,
|
|
expected_list=one_object)
|
|
|
|
# admin has RP rights so can still see all the objects
|
|
self.assert_search_on_attr(str(ou1_dn), self.ldb_admin, attr,
|
|
expected_list=self.full_list)
|
|
|
|
|
|
# tests on ldap delete operations
|
|
|
|
|
|
class AclDeleteTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclDeleteTests, self).setUp()
|
|
self.regular_user = "acl_delete_user1"
|
|
# Create regular user
|
|
self.ldb_admin.newuser(self.regular_user, self.user_pass)
|
|
self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
|
|
|
|
def tearDown(self):
|
|
super(AclDeleteTests, self).tearDown()
|
|
delete_force(self.ldb_admin, self.get_user_dn("test_delete_user1"))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
|
|
delete_force(self.ldb_admin, self.get_user_dn("test_anonymous"))
|
|
|
|
del self.ldb_user
|
|
|
|
def test_delete_u1(self):
|
|
"""User is prohibited by default to delete another User object"""
|
|
# Create user that we try to delete
|
|
self.ldb_admin.newuser("test_delete_user1", self.user_pass)
|
|
# Here delete User object should ALWAYS through exception
|
|
try:
|
|
self.ldb_user.delete(self.get_user_dn("test_delete_user1"))
|
|
except LdbError as e19:
|
|
(num, _) = e19.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_delete_u2(self):
|
|
"""User's group has RIGHT_DELETE to another User object"""
|
|
user_dn = self.get_user_dn("test_delete_user1")
|
|
# Create user that we try to delete
|
|
self.ldb_admin.newuser("test_delete_user1", self.user_pass)
|
|
mod = "(A;;SD;;;AU)"
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
# Try to delete User object
|
|
self.ldb_user.delete(user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
|
|
def test_delete_u3(self):
|
|
"""User identified by SID has RIGHT_DELETE to another User object"""
|
|
user_dn = self.get_user_dn("test_delete_user1")
|
|
# Create user that we try to delete
|
|
self.ldb_admin.newuser("test_delete_user1", self.user_pass)
|
|
mod = "(A;;SD;;;%s)" % self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
# Try to delete User object
|
|
self.ldb_user.delete(user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
|
|
def test_delete_anonymous(self):
|
|
"""Test add operation with anonymous user"""
|
|
anonymous = SamDB(url=ldaphost, credentials=self.creds_tmp, lp=lp)
|
|
self.ldb_admin.newuser("test_anonymous", "samba123@")
|
|
|
|
try:
|
|
anonymous.delete(self.get_user_dn("test_anonymous"))
|
|
except LdbError as e20:
|
|
(num, _) = e20.args
|
|
self.assertEqual(num, ERR_OPERATIONS_ERROR)
|
|
else:
|
|
self.fail()
|
|
|
|
# tests on ldap rename operations
|
|
|
|
|
|
class AclRenameTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclRenameTests, self).setUp()
|
|
self.regular_user = "acl_rename_user1"
|
|
self.ou1 = "OU=test_rename_ou1"
|
|
self.ou2 = "OU=test_rename_ou2"
|
|
self.ou3 = "OU=test_rename_ou3,%s" % self.ou2
|
|
self.testuser1 = "test_rename_user1"
|
|
self.testuser2 = "test_rename_user2"
|
|
self.testuser3 = "test_rename_user3"
|
|
self.testuser4 = "test_rename_user4"
|
|
self.testuser5 = "test_rename_user5"
|
|
# Create regular user
|
|
self.ldb_admin.newuser(self.regular_user, self.user_pass)
|
|
self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
|
|
|
|
def tearDown(self):
|
|
super(AclRenameTests, self).tearDown()
|
|
# Rename OU3
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser1, self.ou3, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser2, self.ou3, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser5, self.ou3, self.base_dn))
|
|
delete_force(self.ldb_admin, "%s,%s" % (self.ou3, self.base_dn))
|
|
# Rename OU2
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser1, self.ou2, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser2, self.ou2, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser5, self.ou2, self.base_dn))
|
|
delete_force(self.ldb_admin, "%s,%s" % (self.ou2, self.base_dn))
|
|
# Rename OU1
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser1, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser2, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser5, self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "OU=test_rename_ou3,%s,%s" % (self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, "%s,%s" % (self.ou1, self.base_dn))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
|
|
|
|
del self.ldb_user
|
|
|
|
def test_rename_u1(self):
|
|
"""Regular user fails to rename 'User object' within single OU"""
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou("OU=test_rename_ou1," + self.base_dn)
|
|
self.ldb_admin.newuser(self.testuser1, self.user_pass, userou=self.ou1)
|
|
try:
|
|
self.ldb_user.rename("CN=%s,%s,%s" % (self.testuser1, self.ou1, self.base_dn),
|
|
"CN=%s,%s,%s" % (self.testuser5, self.ou1, self.base_dn))
|
|
except LdbError as e21:
|
|
(num, _) = e21.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_rename_u2(self):
|
|
"""Grant WRITE_PROPERTY to AU so regular user can rename 'User object' within single OU"""
|
|
ou_dn = "OU=test_rename_ou1," + self.base_dn
|
|
user_dn = "CN=test_rename_user1," + ou_dn
|
|
rename_user_dn = "CN=test_rename_user5," + ou_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
self.ldb_admin.newuser(self.testuser1, self.user_pass, userou=self.ou1)
|
|
mod = "(A;;WP;;;AU)"
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
# Rename 'User object' having WP to AU
|
|
self.ldb_user.rename(user_dn, rename_user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % rename_user_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u3(self):
|
|
"""Test rename with rights granted to 'User object' SID"""
|
|
ou_dn = "OU=test_rename_ou1," + self.base_dn
|
|
user_dn = "CN=test_rename_user1," + ou_dn
|
|
rename_user_dn = "CN=test_rename_user5," + ou_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou_dn)
|
|
self.ldb_admin.newuser(self.testuser1, self.user_pass, userou=self.ou1)
|
|
sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = "(A;;WP;;;%s)" % str(sid)
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
# Rename 'User object' having WP to AU
|
|
self.ldb_user.rename(user_dn, rename_user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % rename_user_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u4(self):
|
|
"""Rename 'User object' cross OU with WP, SD and CC right granted on reg. user to AU"""
|
|
ou1_dn = "OU=test_rename_ou1," + self.base_dn
|
|
ou2_dn = "OU=test_rename_ou2," + self.base_dn
|
|
user_dn = "CN=test_rename_user2," + ou1_dn
|
|
rename_user_dn = "CN=test_rename_user5," + ou2_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou1_dn)
|
|
self.ldb_admin.create_ou(ou2_dn)
|
|
self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
|
|
mod = "(A;;WPSD;;;AU)"
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
mod = "(A;;CC;;;AU)"
|
|
self.sd_utils.dacl_add_ace(ou2_dn, mod)
|
|
# Rename 'User object' having SD and CC to AU
|
|
self.ldb_user.rename(user_dn, rename_user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % rename_user_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u5(self):
|
|
"""Test rename with rights granted to 'User object' SID"""
|
|
ou1_dn = "OU=test_rename_ou1," + self.base_dn
|
|
ou2_dn = "OU=test_rename_ou2," + self.base_dn
|
|
user_dn = "CN=test_rename_user2," + ou1_dn
|
|
rename_user_dn = "CN=test_rename_user5," + ou2_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou1_dn)
|
|
self.ldb_admin.create_ou(ou2_dn)
|
|
self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
|
|
sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = "(A;;WPSD;;;%s)" % str(sid)
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
mod = "(A;;CC;;;%s)" % str(sid)
|
|
self.sd_utils.dacl_add_ace(ou2_dn, mod)
|
|
# Rename 'User object' having SD and CC to AU
|
|
self.ldb_user.rename(user_dn, rename_user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % rename_user_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u6(self):
|
|
"""Rename 'User object' cross OU with WP, DC and CC right granted on OU & user to AU"""
|
|
ou1_dn = "OU=test_rename_ou1," + self.base_dn
|
|
ou2_dn = "OU=test_rename_ou2," + self.base_dn
|
|
user_dn = "CN=test_rename_user2," + ou1_dn
|
|
rename_user_dn = "CN=test_rename_user2," + ou2_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou1_dn)
|
|
self.ldb_admin.create_ou(ou2_dn)
|
|
#mod = "(A;CI;DCWP;;;AU)"
|
|
mod = "(A;;DC;;;AU)"
|
|
self.sd_utils.dacl_add_ace(ou1_dn, mod)
|
|
mod = "(A;;CC;;;AU)"
|
|
self.sd_utils.dacl_add_ace(ou2_dn, mod)
|
|
self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
|
|
mod = "(A;;WP;;;AU)"
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
# Rename 'User object' having SD and CC to AU
|
|
self.ldb_user.rename(user_dn, rename_user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % rename_user_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u7(self):
|
|
"""Rename 'User object' cross OU (second level) with WP, DC and CC right granted on OU to AU"""
|
|
ou1_dn = "OU=test_rename_ou1," + self.base_dn
|
|
ou2_dn = "OU=test_rename_ou2," + self.base_dn
|
|
ou3_dn = "OU=test_rename_ou3," + ou2_dn
|
|
user_dn = "CN=test_rename_user2," + ou1_dn
|
|
rename_user_dn = "CN=test_rename_user5," + ou3_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou1_dn)
|
|
self.ldb_admin.create_ou(ou2_dn)
|
|
self.ldb_admin.create_ou(ou3_dn)
|
|
mod = "(A;CI;WPDC;;;AU)"
|
|
self.sd_utils.dacl_add_ace(ou1_dn, mod)
|
|
mod = "(A;;CC;;;AU)"
|
|
self.sd_utils.dacl_add_ace(ou3_dn, mod)
|
|
self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
|
|
# Rename 'User object' having SD and CC to AU
|
|
self.ldb_user.rename(user_dn, rename_user_dn)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % user_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn,
|
|
expression="(distinguishedName=%s)" % rename_user_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u8(self):
|
|
"""Test rename on an object with and without modify access on the RDN attribute"""
|
|
ou1_dn = "OU=test_rename_ou1," + self.base_dn
|
|
ou2_dn = "OU=test_rename_ou2," + ou1_dn
|
|
ou3_dn = "OU=test_rename_ou3," + ou1_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou1_dn)
|
|
self.ldb_admin.create_ou(ou2_dn)
|
|
sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = "(OA;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
|
|
self.sd_utils.dacl_add_ace(ou2_dn, mod)
|
|
mod = "(OD;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
|
|
self.sd_utils.dacl_add_ace(ou2_dn, mod)
|
|
try:
|
|
self.ldb_user.rename(ou2_dn, ou3_dn)
|
|
except LdbError as e22:
|
|
(num, _) = e22.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
# This rename operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
|
|
self.fail()
|
|
sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
mod = "(A;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
|
|
self.sd_utils.dacl_add_ace(ou2_dn, mod)
|
|
self.ldb_user.rename(ou2_dn, ou3_dn)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % ou2_dn)
|
|
self.assertEqual(len(res), 0)
|
|
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % ou3_dn)
|
|
self.assertNotEqual(len(res), 0)
|
|
|
|
def test_rename_u9(self):
|
|
"""Rename 'User object' cross OU, with explicit deny on sd and dc"""
|
|
ou1_dn = "OU=test_rename_ou1," + self.base_dn
|
|
ou2_dn = "OU=test_rename_ou2," + self.base_dn
|
|
user_dn = "CN=test_rename_user2," + ou1_dn
|
|
rename_user_dn = "CN=test_rename_user5," + ou2_dn
|
|
# Create OU structure
|
|
self.ldb_admin.create_ou(ou1_dn)
|
|
self.ldb_admin.create_ou(ou2_dn)
|
|
self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
|
|
mod = "(D;;SD;;;DA)"
|
|
self.sd_utils.dacl_add_ace(user_dn, mod)
|
|
mod = "(D;;DC;;;DA)"
|
|
self.sd_utils.dacl_add_ace(ou1_dn, mod)
|
|
# Rename 'User object' having SD and CC to AU
|
|
try:
|
|
self.ldb_admin.rename(user_dn, rename_user_dn)
|
|
except LdbError as e23:
|
|
(num, _) = e23.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
# add an allow ace so we can delete this ou
|
|
mod = "(A;;DC;;;DA)"
|
|
self.sd_utils.dacl_add_ace(ou1_dn, mod)
|
|
|
|
|
|
# tests on Control Access Rights
|
|
class AclCARTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclCARTests, self).setUp()
|
|
|
|
# Get the old "dSHeuristics" if it was set
|
|
dsheuristics = self.ldb_admin.get_dsheuristics()
|
|
# Reset the "dSHeuristics" as they were before
|
|
self.addCleanup(self.ldb_admin.set_dsheuristics, dsheuristics)
|
|
# Set the "dSHeuristics" to activate the correct "userPassword" behaviour
|
|
self.ldb_admin.set_dsheuristics("000000001")
|
|
# Get the old "minPwdAge"
|
|
minPwdAge = self.ldb_admin.get_minPwdAge()
|
|
# Reset the "minPwdAge" as it was before
|
|
self.addCleanup(self.ldb_admin.set_minPwdAge, minPwdAge)
|
|
# Set it temporarily to "0"
|
|
self.ldb_admin.set_minPwdAge("0")
|
|
|
|
self.user_with_wp = "acl_car_user1"
|
|
self.user_with_pc = "acl_car_user2"
|
|
self.ldb_admin.newuser(self.user_with_wp, self.user_pass)
|
|
self.ldb_admin.newuser(self.user_with_pc, self.user_pass)
|
|
self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
|
|
self.ldb_user2 = self.get_ldb_connection(self.user_with_pc, self.user_pass)
|
|
|
|
def tearDown(self):
|
|
super(AclCARTests, self).tearDown()
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.user_with_pc))
|
|
|
|
del self.ldb_user
|
|
del self.ldb_user2
|
|
|
|
def test_change_password1(self):
|
|
"""Try a password change operation without any CARs given"""
|
|
# users have change password by default - remove for negative testing
|
|
desc = self.sd_utils.read_sd_on_dn(self.get_user_dn(self.user_with_wp))
|
|
sddl = desc.as_sddl(self.domain_sid)
|
|
sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
|
|
sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
|
|
self.sd_utils.modify_sd_on_dn(self.get_user_dn(self.user_with_wp), sddl)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')).decode('utf8') + """
|
|
add: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
except LdbError as e24:
|
|
(num, _) = e24.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
# for some reason we get constraint violation instead of insufficient access error
|
|
self.fail()
|
|
|
|
def test_change_password2(self):
|
|
"""Make sure WP has no influence"""
|
|
desc = self.sd_utils.read_sd_on_dn(self.get_user_dn(self.user_with_wp))
|
|
sddl = desc.as_sddl(self.domain_sid)
|
|
sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
|
|
sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
|
|
self.sd_utils.modify_sd_on_dn(self.get_user_dn(self.user_with_wp), sddl)
|
|
mod = "(A;;WP;;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')).decode('utf8') + """
|
|
add: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
except LdbError as e25:
|
|
(num, _) = e25.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
# for some reason we get constraint violation instead of insufficient access error
|
|
self.fail()
|
|
|
|
def test_change_password3(self):
|
|
"""Make sure WP has no influence"""
|
|
mod = "(D;;WP;;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')).decode('utf8') + """
|
|
add: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
|
|
def test_change_password5(self):
|
|
"""Make sure rights have no influence on dBCSPwd"""
|
|
desc = self.sd_utils.read_sd_on_dn(self.get_user_dn(self.user_with_wp))
|
|
sddl = desc.as_sddl(self.domain_sid)
|
|
sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
|
|
sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
|
|
self.sd_utils.modify_sd_on_dn(self.get_user_dn(self.user_with_wp), sddl)
|
|
mod = "(D;;WP;;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: dBCSPwd
|
|
dBCSPwd: XXXXXXXXXXXXXXXX
|
|
add: dBCSPwd
|
|
dBCSPwd: YYYYYYYYYYYYYYYY
|
|
""")
|
|
except LdbError as e26:
|
|
(num, _) = e26.args
|
|
self.assertEqual(num, ERR_UNWILLING_TO_PERFORM)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_change_password6(self):
|
|
"""Test uneven delete/adds"""
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
delete: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
add: userPassword
|
|
userPassword: thatsAcomplPASS2
|
|
""")
|
|
except LdbError as e27:
|
|
(num, _) = e27.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
delete: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
add: userPassword
|
|
userPassword: thatsAcomplPASS2
|
|
""")
|
|
# This fails on Windows 2000 domain level with constraint violation
|
|
except LdbError as e28:
|
|
(num, _) = e28.args
|
|
self.assertIn(num, (ERR_CONSTRAINT_VIOLATION,
|
|
ERR_UNWILLING_TO_PERFORM))
|
|
else:
|
|
self.fail()
|
|
|
|
def test_change_password7(self):
|
|
"""Try a password change operation without any CARs given"""
|
|
# users have change password by default - remove for negative testing
|
|
desc = self.sd_utils.read_sd_on_dn(self.get_user_dn(self.user_with_wp))
|
|
sddl = desc.as_sddl(self.domain_sid)
|
|
self.sd_utils.modify_sd_on_dn(self.get_user_dn(self.user_with_wp), sddl)
|
|
# first change our own password
|
|
self.ldb_user2.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_pc) + """
|
|
changetype: modify
|
|
delete: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')).decode('utf8') + """
|
|
add: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
# then someone else's
|
|
self.ldb_user2.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
delete: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')).decode('utf8') + """
|
|
add: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
|
|
def test_reset_password1(self):
|
|
"""Try a user password reset operation (unicodePwd) before and after granting CAR"""
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
except LdbError as e29:
|
|
(num, _) = e29.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
|
|
def test_reset_password2(self):
|
|
"""Try a user password reset operation (userPassword) before and after granting CAR"""
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
""")
|
|
except LdbError as e30:
|
|
(num, _) = e30.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
""")
|
|
# This fails on Windows 2000 domain level with constraint violation
|
|
except LdbError as e31:
|
|
(num, _) = e31.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
pass # Not self.fail() as we normally want success.
|
|
|
|
def test_reset_password3(self):
|
|
"""Grant WP and see what happens (unicodePwd)"""
|
|
mod = "(A;;WP;;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
except LdbError as e32:
|
|
(num, _) = e32.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_reset_password4(self):
|
|
"""Grant WP and see what happens (userPassword)"""
|
|
mod = "(A;;WP;;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
""")
|
|
except LdbError as e33:
|
|
(num, _) = e33.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_reset_password5(self):
|
|
"""Explicitly deny WP but grant CAR (unicodePwd)"""
|
|
mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: unicodePwd
|
|
unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')).decode('utf8') + """
|
|
""")
|
|
|
|
def test_reset_password6(self):
|
|
"""Explicitly deny WP but grant CAR (userPassword)"""
|
|
mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
|
|
self.sd_utils.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
|
|
try:
|
|
self.ldb_user.modify_ldif("""
|
|
dn: """ + self.get_user_dn(self.user_with_wp) + """
|
|
changetype: modify
|
|
replace: userPassword
|
|
userPassword: thatsAcomplPASS1
|
|
""")
|
|
# This fails on Windows 2000 domain level with constraint violation
|
|
except LdbError as e34:
|
|
(num, _) = e34.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
pass # Not self.fail() as we normally want success
|
|
|
|
|
|
class AclExtendedTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclExtendedTests, self).setUp()
|
|
# regular user, will be the creator
|
|
self.u1 = "ext_u1"
|
|
# regular user
|
|
self.u2 = "ext_u2"
|
|
# admin user
|
|
self.u3 = "ext_u3"
|
|
self.ldb_admin.newuser(self.u1, self.user_pass)
|
|
self.ldb_admin.newuser(self.u2, self.user_pass)
|
|
self.ldb_admin.newuser(self.u3, self.user_pass)
|
|
self.ldb_admin.add_remove_group_members("Domain Admins", [self.u3],
|
|
add_members_operation=True)
|
|
self.ldb_user1 = self.get_ldb_connection(self.u1, self.user_pass)
|
|
self.ldb_user2 = self.get_ldb_connection(self.u2, self.user_pass)
|
|
self.ldb_user3 = self.get_ldb_connection(self.u3, self.user_pass)
|
|
self.user_sid1 = self.sd_utils.get_object_sid(self.get_user_dn(self.u1))
|
|
self.user_sid2 = self.sd_utils.get_object_sid(self.get_user_dn(self.u2))
|
|
|
|
def tearDown(self):
|
|
super(AclExtendedTests, self).tearDown()
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.u1))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.u2))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.u3))
|
|
delete_force(self.ldb_admin, "CN=ext_group1,OU=ext_ou1," + self.base_dn)
|
|
delete_force(self.ldb_admin, "ou=ext_ou1," + self.base_dn)
|
|
|
|
del self.ldb_user1
|
|
del self.ldb_user2
|
|
del self.ldb_user3
|
|
|
|
def test_ntSecurityDescriptor(self):
|
|
# create empty ou
|
|
self.ldb_admin.create_ou("ou=ext_ou1," + self.base_dn)
|
|
# give u1 Create children access
|
|
mod = "(A;;CC;;;%s)" % str(self.user_sid1)
|
|
self.sd_utils.dacl_add_ace("OU=ext_ou1," + self.base_dn, mod)
|
|
mod = "(A;;LC;;;%s)" % str(self.user_sid2)
|
|
self.sd_utils.dacl_add_ace("OU=ext_ou1," + self.base_dn, mod)
|
|
# create a group under that, grant RP to u2
|
|
self.ldb_user1.newgroup("ext_group1", groupou="OU=ext_ou1",
|
|
grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
|
|
mod = "(A;;RP;;;%s)" % str(self.user_sid2)
|
|
self.sd_utils.dacl_add_ace("CN=ext_group1,OU=ext_ou1," + self.base_dn, mod)
|
|
# u2 must not read the descriptor
|
|
res = self.ldb_user2.search("CN=ext_group1,OU=ext_ou1," + self.base_dn,
|
|
SCOPE_BASE, None, ["nTSecurityDescriptor"])
|
|
self.assertNotEqual(len(res), 0)
|
|
self.assertNotIn("nTSecurityDescriptor", res[0].keys())
|
|
# grant RC to u2 - still no access
|
|
mod = "(A;;RC;;;%s)" % str(self.user_sid2)
|
|
self.sd_utils.dacl_add_ace("CN=ext_group1,OU=ext_ou1," + self.base_dn, mod)
|
|
res = self.ldb_user2.search("CN=ext_group1,OU=ext_ou1," + self.base_dn,
|
|
SCOPE_BASE, None, ["nTSecurityDescriptor"])
|
|
self.assertNotEqual(len(res), 0)
|
|
self.assertNotIn("nTSecurityDescriptor", res[0].keys())
|
|
# u3 is member of administrators group, should be able to read sd
|
|
res = self.ldb_user3.search("CN=ext_group1,OU=ext_ou1," + self.base_dn,
|
|
SCOPE_BASE, None, ["nTSecurityDescriptor"])
|
|
self.assertEqual(len(res), 1)
|
|
self.assertIn("nTSecurityDescriptor", res[0].keys())
|
|
|
|
|
|
class AclUndeleteTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclUndeleteTests, self).setUp()
|
|
self.regular_user = "undeleter1"
|
|
self.ou1 = "OU=undeleted_ou,"
|
|
self.testuser1 = "to_be_undeleted1"
|
|
self.testuser2 = "to_be_undeleted2"
|
|
self.testuser3 = "to_be_undeleted3"
|
|
self.testuser4 = "to_be_undeleted4"
|
|
self.testuser5 = "to_be_undeleted5"
|
|
self.testuser6 = "to_be_undeleted6"
|
|
|
|
self.new_dn_ou = "CN=" + self.testuser4 + "," + self.ou1 + self.base_dn
|
|
|
|
# Create regular user
|
|
self.testuser1_dn = self.get_user_dn(self.testuser1)
|
|
self.testuser2_dn = self.get_user_dn(self.testuser2)
|
|
self.testuser3_dn = self.get_user_dn(self.testuser3)
|
|
self.testuser4_dn = self.get_user_dn(self.testuser4)
|
|
self.testuser5_dn = self.get_user_dn(self.testuser5)
|
|
self.deleted_dn1 = self.create_delete_user(self.testuser1)
|
|
self.deleted_dn2 = self.create_delete_user(self.testuser2)
|
|
self.deleted_dn3 = self.create_delete_user(self.testuser3)
|
|
self.deleted_dn4 = self.create_delete_user(self.testuser4)
|
|
self.deleted_dn5 = self.create_delete_user(self.testuser5)
|
|
|
|
self.ldb_admin.create_ou(self.ou1 + self.base_dn)
|
|
|
|
self.ldb_admin.newuser(self.regular_user, self.user_pass)
|
|
self.ldb_admin.add_remove_group_members("Domain Admins", [self.regular_user],
|
|
add_members_operation=True)
|
|
self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
|
|
self.sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
|
|
|
|
def tearDown(self):
|
|
super(AclUndeleteTests, self).tearDown()
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.testuser1))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.testuser2))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.testuser3))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.testuser4))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.testuser5))
|
|
delete_force(self.ldb_admin, self.new_dn_ou)
|
|
delete_force(self.ldb_admin, self.ou1 + self.base_dn)
|
|
|
|
del self.ldb_user
|
|
|
|
def GUID_string(self, guid):
|
|
return get_string(ldb.schema_format_value("objectGUID", guid))
|
|
|
|
def create_delete_user(self, new_user):
|
|
self.ldb_admin.newuser(new_user, self.user_pass)
|
|
|
|
res = self.ldb_admin.search(expression="(objectClass=*)",
|
|
base=self.get_user_dn(new_user),
|
|
scope=SCOPE_BASE,
|
|
controls=["show_deleted:1"])
|
|
guid = res[0]["objectGUID"][0]
|
|
self.ldb_admin.delete(self.get_user_dn(new_user))
|
|
res = self.ldb_admin.search(base="<GUID=%s>" % self.GUID_string(guid),
|
|
scope=SCOPE_BASE, controls=["show_deleted:1"])
|
|
self.assertEqual(len(res), 1)
|
|
return str(res[0].dn)
|
|
|
|
def undelete_deleted(self, olddn, newdn):
|
|
msg = Message()
|
|
msg.dn = Dn(self.ldb_user, olddn)
|
|
msg["isDeleted"] = MessageElement([], FLAG_MOD_DELETE, "isDeleted")
|
|
msg["distinguishedName"] = MessageElement([newdn], FLAG_MOD_REPLACE, "distinguishedName")
|
|
self.ldb_user.modify(msg, ["show_recycled:1"])
|
|
|
|
def undelete_deleted_with_mod(self, olddn, newdn):
|
|
msg = Message()
|
|
msg.dn = Dn(ldb, olddn)
|
|
msg["isDeleted"] = MessageElement([], FLAG_MOD_DELETE, "isDeleted")
|
|
msg["distinguishedName"] = MessageElement([newdn], FLAG_MOD_REPLACE, "distinguishedName")
|
|
msg["url"] = MessageElement(["www.samba.org"], FLAG_MOD_REPLACE, "url")
|
|
self.ldb_user.modify(msg, ["show_deleted:1"])
|
|
|
|
def test_undelete(self):
|
|
# it appears the user has to have LC on the old parent to be able to move the object
|
|
# otherwise we get no such object. Since only System can modify the SD on deleted object
|
|
# we cannot grant this permission via LDAP, and this leaves us with "negative" tests at the moment
|
|
|
|
# deny write property on rdn, should fail
|
|
mod = "(OD;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.deleted_dn1, mod)
|
|
try:
|
|
self.undelete_deleted(self.deleted_dn1, self.testuser1_dn)
|
|
self.fail()
|
|
except LdbError as e35:
|
|
(num, _) = e35.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
|
|
# seems that permissions on isDeleted and distinguishedName are irrelevant
|
|
mod = "(OD;;WP;bf96798f-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.deleted_dn2, mod)
|
|
mod = "(OD;;WP;bf9679e4-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.deleted_dn2, mod)
|
|
self.undelete_deleted(self.deleted_dn2, self.testuser2_dn)
|
|
|
|
# attempt undelete with simultaneous addition of url, WP to which is denied
|
|
mod = "(OD;;WP;9a9a0221-4a5b-11d1-a9c3-0000f80367c1;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.deleted_dn3, mod)
|
|
try:
|
|
self.undelete_deleted_with_mod(self.deleted_dn3, self.testuser3_dn)
|
|
self.fail()
|
|
except LdbError as e36:
|
|
(num, _) = e36.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
|
|
# undelete in an ou, in which we have no right to create children
|
|
mod = "(D;;CC;;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.ou1 + self.base_dn, mod)
|
|
try:
|
|
self.undelete_deleted(self.deleted_dn4, self.new_dn_ou)
|
|
self.fail()
|
|
except LdbError as e37:
|
|
(num, _) = e37.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
|
|
# delete is not required
|
|
mod = "(D;;SD;;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.deleted_dn5, mod)
|
|
self.undelete_deleted(self.deleted_dn5, self.testuser5_dn)
|
|
|
|
# deny Reanimate-Tombstone, should fail
|
|
mod = "(OD;;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;%s)" % str(self.sid)
|
|
self.sd_utils.dacl_add_ace(self.base_dn, mod)
|
|
try:
|
|
self.undelete_deleted(self.deleted_dn4, self.testuser4_dn)
|
|
self.fail()
|
|
except LdbError as e38:
|
|
(num, _) = e38.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
self.sd_utils.dacl_delete_aces(self.base_dn, mod)
|
|
|
|
|
|
class AclSPNTests(AclTests):
|
|
|
|
def setUp(self):
|
|
super(AclSPNTests, self).setUp()
|
|
self.dcname = "TESTSRV8"
|
|
self.rodcname = "TESTRODC8"
|
|
self.computername = "testcomp8"
|
|
self.test_user = "spn_test_user8"
|
|
self.computerdn = "CN=%s,CN=computers,%s" % (self.computername, self.base_dn)
|
|
self.user_object = "user_with_spn"
|
|
self.user_object_dn = "CN=%s,CN=Users,%s" % (self.user_object, self.base_dn)
|
|
self.dc_dn = "CN=%s,OU=Domain Controllers,%s" % (self.dcname, self.base_dn)
|
|
self.site = "Default-First-Site-Name"
|
|
self.rodcctx = DCJoinContext(server=host, creds=creds, lp=lp,
|
|
site=self.site, netbios_name=self.rodcname,
|
|
targetdir=None, domain=None)
|
|
self.dcctx = DCJoinContext(server=host, creds=creds, lp=lp,
|
|
site=self.site, netbios_name=self.dcname,
|
|
targetdir=None, domain=None)
|
|
self.ldb_admin.newuser(self.test_user, self.user_pass)
|
|
self.ldb_user1 = self.get_ldb_connection(self.test_user, self.user_pass)
|
|
self.user_sid1 = self.sd_utils.get_object_sid(self.get_user_dn(self.test_user))
|
|
self.create_computer(self.computername, self.dcctx.dnsdomain)
|
|
self.create_rodc(self.rodcctx)
|
|
self.create_dc(self.dcctx)
|
|
|
|
def tearDown(self):
|
|
super(AclSPNTests, self).tearDown()
|
|
self.rodcctx.cleanup_old_join()
|
|
self.dcctx.cleanup_old_join()
|
|
delete_force(self.ldb_admin, "cn=%s,cn=computers,%s" % (self.computername, self.base_dn))
|
|
delete_force(self.ldb_admin, self.get_user_dn(self.test_user))
|
|
delete_force(self.ldb_admin, self.user_object_dn)
|
|
|
|
del self.ldb_user1
|
|
|
|
def replace_spn(self, _ldb, dn, spn):
|
|
print("Setting spn %s on %s" % (spn, dn))
|
|
res = self.ldb_admin.search(dn, expression="(objectClass=*)",
|
|
scope=SCOPE_BASE, attrs=["servicePrincipalName"])
|
|
if "servicePrincipalName" in res[0].keys():
|
|
flag = FLAG_MOD_REPLACE
|
|
else:
|
|
flag = FLAG_MOD_ADD
|
|
|
|
msg = Message()
|
|
msg.dn = Dn(self.ldb_admin, dn)
|
|
msg["servicePrincipalName"] = MessageElement(spn, flag,
|
|
"servicePrincipalName")
|
|
_ldb.modify(msg)
|
|
|
|
def create_computer(self, computername, domainname):
|
|
dn = "CN=%s,CN=computers,%s" % (computername, self.base_dn)
|
|
samaccountname = computername + "$"
|
|
dnshostname = "%s.%s" % (computername, domainname)
|
|
self.ldb_admin.add({
|
|
"dn": dn,
|
|
"objectclass": "computer",
|
|
"sAMAccountName": samaccountname,
|
|
"userAccountControl": str(samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT),
|
|
"dNSHostName": dnshostname})
|
|
|
|
# same as for join_RODC, but do not set any SPNs
|
|
def create_rodc(self, ctx):
|
|
ctx.nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
|
|
ctx.full_nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
|
|
ctx.krbtgt_dn = "CN=krbtgt_%s,CN=Users,%s" % (ctx.myname, ctx.base_dn)
|
|
|
|
ctx.never_reveal_sid = ["<SID=%s-%s>" % (ctx.domsid, security.DOMAIN_RID_RODC_DENY),
|
|
"<SID=%s>" % security.SID_BUILTIN_ADMINISTRATORS,
|
|
"<SID=%s>" % security.SID_BUILTIN_SERVER_OPERATORS,
|
|
"<SID=%s>" % security.SID_BUILTIN_BACKUP_OPERATORS,
|
|
"<SID=%s>" % security.SID_BUILTIN_ACCOUNT_OPERATORS]
|
|
ctx.reveal_sid = "<SID=%s-%s>" % (ctx.domsid, security.DOMAIN_RID_RODC_ALLOW)
|
|
|
|
mysid = ctx.get_mysid()
|
|
admin_dn = "<SID=%s>" % mysid
|
|
ctx.managedby = admin_dn
|
|
|
|
ctx.userAccountControl = (samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT |
|
|
samba.dsdb.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION |
|
|
samba.dsdb.UF_PARTIAL_SECRETS_ACCOUNT)
|
|
|
|
ctx.connection_dn = "CN=RODC Connection (FRS),%s" % ctx.ntds_dn
|
|
ctx.secure_channel_type = misc.SEC_CHAN_RODC
|
|
ctx.RODC = True
|
|
ctx.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
|
|
drsuapi.DRSUAPI_DRS_PER_SYNC |
|
|
drsuapi.DRSUAPI_DRS_GET_ANC |
|
|
drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
|
|
drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
|
|
|
|
ctx.join_add_objects()
|
|
|
|
def create_dc(self, ctx):
|
|
ctx.nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
|
|
ctx.full_nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
|
|
ctx.userAccountControl = samba.dsdb.UF_SERVER_TRUST_ACCOUNT | samba.dsdb.UF_TRUSTED_FOR_DELEGATION
|
|
ctx.secure_channel_type = misc.SEC_CHAN_BDC
|
|
ctx.replica_flags = (drsuapi.DRSUAPI_DRS_WRIT_REP |
|
|
drsuapi.DRSUAPI_DRS_INIT_SYNC |
|
|
drsuapi.DRSUAPI_DRS_PER_SYNC |
|
|
drsuapi.DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS |
|
|
drsuapi.DRSUAPI_DRS_NEVER_SYNCED)
|
|
|
|
ctx.join_add_objects()
|
|
|
|
def dc_spn_test(self, ctx):
|
|
netbiosdomain = self.dcctx.get_domain_name()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "HOST/%s/%s" % (ctx.myname, netbiosdomain))
|
|
except LdbError as e39:
|
|
(num, _) = e39.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
mod = "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;%s)" % str(self.user_sid1)
|
|
self.sd_utils.dacl_add_ace(ctx.acct_dn, mod)
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "HOST/%s/%s" % (ctx.myname, netbiosdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "HOST/%s" % (ctx.myname))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "HOST/%s.%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain, netbiosdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "HOST/%s/%s" % (ctx.myname, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "HOST/%s.%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "GC/%s.%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain, ctx.dnsforest))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s/%s" % (ctx.myname, netbiosdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s.%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain, netbiosdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s" % (ctx.myname))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s/%s" % (ctx.myname, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s.%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "DNS/%s/%s" % (ctx.myname, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "RestrictedKrbHost/%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "RestrictedKrbHost/%s" %
|
|
(ctx.myname))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain))
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s._msdcs.%s" %
|
|
(ctx.ntds_guid, ctx.dnsdomain))
|
|
|
|
# the following spns do not match the restrictions and should fail
|
|
try:
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s.%s/ForestDnsZones.%s" %
|
|
(ctx.myname, ctx.dnsdomain, ctx.dnsdomain))
|
|
except LdbError as e40:
|
|
(num, _) = e40.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "ldap/%s.%s/DomainDnsZones.%s" %
|
|
(ctx.myname, ctx.dnsdomain, ctx.dnsdomain))
|
|
except LdbError as e41:
|
|
(num, _) = e41.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "nosuchservice/%s/%s" % ("abcd", "abcd"))
|
|
except LdbError as e42:
|
|
(num, _) = e42.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "GC/%s.%s/%s" %
|
|
(ctx.myname, ctx.dnsdomain, netbiosdomain))
|
|
except LdbError as e43:
|
|
(num, _) = e43.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, ctx.acct_dn, "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s" %
|
|
(ctx.ntds_guid, ctx.dnsdomain))
|
|
except LdbError as e44:
|
|
(num, _) = e44.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_computer_spn(self):
|
|
# with WP, any value can be set
|
|
netbiosdomain = self.dcctx.get_domain_name()
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "HOST/%s/%s" %
|
|
(self.computername, netbiosdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "HOST/%s" % (self.computername))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "HOST/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, netbiosdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "HOST/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "HOST/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "GC/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsforest))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s/%s" % (self.computername, netbiosdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s.%s/ForestDnsZones.%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s.%s/DomainDnsZones.%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, netbiosdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s" % (self.computername))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "ldap/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "DNS/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "RestrictedKrbHost/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "RestrictedKrbHost/%s" %
|
|
(self.computername))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
self.replace_spn(self.ldb_admin, self.computerdn, "nosuchservice/%s/%s" % ("abcd", "abcd"))
|
|
|
|
# user has neither WP nor Validated-SPN, access denied expected
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s/%s" % (self.computername, netbiosdomain))
|
|
except LdbError as e45:
|
|
(num, _) = e45.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
mod = "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;%s)" % str(self.user_sid1)
|
|
self.sd_utils.dacl_add_ace(self.computerdn, mod)
|
|
# grant Validated-SPN and check which values are accepted
|
|
# see 3.1.1.5.3.1.1.4 servicePrincipalName for reference
|
|
|
|
# for regular computer objects we shouldalways get constraint violation
|
|
|
|
# This does not pass against Windows, although it should according to docs
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s" % (self.computername))
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s.%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s/%s" % (self.computername, netbiosdomain))
|
|
except LdbError as e46:
|
|
(num, _) = e46.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, netbiosdomain))
|
|
except LdbError as e47:
|
|
(num, _) = e47.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain))
|
|
except LdbError as e48:
|
|
(num, _) = e48.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "HOST/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsdomain))
|
|
except LdbError as e49:
|
|
(num, _) = e49.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "GC/%s.%s/%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsforest))
|
|
except LdbError as e50:
|
|
(num, _) = e50.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "ldap/%s/%s" % (self.computername, netbiosdomain))
|
|
except LdbError as e51:
|
|
(num, _) = e51.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.computerdn, "ldap/%s.%s/ForestDnsZones.%s" %
|
|
(self.computername, self.dcctx.dnsdomain, self.dcctx.dnsdomain))
|
|
except LdbError as e52:
|
|
(num, _) = e52.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_spn_rwdc(self):
|
|
self.dc_spn_test(self.dcctx)
|
|
|
|
def test_spn_rodc(self):
|
|
self.dc_spn_test(self.rodcctx)
|
|
|
|
def test_user_spn(self):
|
|
#grant SW to a regular user and try to set the spn on a user object
|
|
#should get ERR_INSUFFICIENT_ACCESS_RIGHTS, since Validate-SPN only applies to computer
|
|
self.ldb_admin.newuser(self.user_object, self.user_pass)
|
|
mod = "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;%s)" % str(self.user_sid1)
|
|
self.sd_utils.dacl_add_ace(self.user_object_dn, mod)
|
|
try:
|
|
self.replace_spn(self.ldb_user1, self.user_object_dn, "nosuchservice/%s/%s" % ("abcd", "abcd"))
|
|
except LdbError as e60:
|
|
(num, _) = e60.args
|
|
self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
else:
|
|
self.fail()
|
|
|
|
def test_delete_add_spn(self):
|
|
# Grant Validated-SPN property.
|
|
mod = f'(OA;;SW;{security.GUID_DRS_VALIDATE_SPN};;{self.user_sid1})'
|
|
self.sd_utils.dacl_add_ace(self.computerdn, mod)
|
|
|
|
spn_base = f'HOST/{self.computername}'
|
|
|
|
allowed_spn = f'{spn_base}.{self.dcctx.dnsdomain}'
|
|
not_allowed_spn = f'{spn_base}/{self.dcctx.get_domain_name()}'
|
|
|
|
# Ensure we are able to add an allowed SPN.
|
|
msg = Message(Dn(self.ldb_user1, self.computerdn))
|
|
msg['servicePrincipalName'] = MessageElement(allowed_spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
self.ldb_user1.modify(msg)
|
|
|
|
# Ensure we are not able to add a disallowed SPN.
|
|
msg = Message(Dn(self.ldb_user1, self.computerdn))
|
|
msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
try:
|
|
self.ldb_user1.modify(msg)
|
|
except LdbError as e:
|
|
num, _ = e.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail(f'able to add disallowed SPN {not_allowed_spn}')
|
|
|
|
# Ensure that deleting an existing SPN followed by adding a disallowed
|
|
# SPN fails.
|
|
msg = Message(Dn(self.ldb_user1, self.computerdn))
|
|
msg['0'] = MessageElement([],
|
|
FLAG_MOD_DELETE,
|
|
'servicePrincipalName')
|
|
msg['1'] = MessageElement(not_allowed_spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
try:
|
|
self.ldb_user1.modify(msg)
|
|
except LdbError as e:
|
|
num, _ = e.args
|
|
self.assertEqual(num, ERR_CONSTRAINT_VIOLATION)
|
|
else:
|
|
self.fail(f'able to add disallowed SPN {not_allowed_spn}')
|
|
|
|
def test_delete_disallowed_spn(self):
|
|
# Grant Validated-SPN property.
|
|
mod = f'(OA;;SW;{security.GUID_DRS_VALIDATE_SPN};;{self.user_sid1})'
|
|
self.sd_utils.dacl_add_ace(self.computerdn, mod)
|
|
|
|
spn_base = f'HOST/{self.computername}'
|
|
|
|
not_allowed_spn = f'{spn_base}/{self.dcctx.get_domain_name()}'
|
|
|
|
# Add a disallowed SPN as admin.
|
|
msg = Message(Dn(self.ldb_admin, self.computerdn))
|
|
msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
|
|
FLAG_MOD_ADD,
|
|
'servicePrincipalName')
|
|
self.ldb_admin.modify(msg)
|
|
|
|
# Ensure we are able to delete a disallowed SPN.
|
|
msg = Message(Dn(self.ldb_user1, self.computerdn))
|
|
msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
|
|
FLAG_MOD_DELETE,
|
|
'servicePrincipalName')
|
|
try:
|
|
self.ldb_user1.modify(msg)
|
|
except LdbError:
|
|
self.fail(f'unable to delete disallowed SPN {not_allowed_spn}')
|
|
|
|
|
|
# tests SEC_ADS_LIST vs. SEC_ADS_LIST_OBJECT
|
|
@DynamicTestCase
|
|
class AclVisibiltyTests(AclTests):
|
|
|
|
envs = {
|
|
"No": False,
|
|
"Do": True,
|
|
}
|
|
modes = {
|
|
"Allow": False,
|
|
"Deny": True,
|
|
}
|
|
perms = {
|
|
"nn": 0,
|
|
"Cn": security.SEC_ADS_LIST,
|
|
"nO": security.SEC_ADS_LIST_OBJECT,
|
|
"CO": security.SEC_ADS_LIST | security.SEC_ADS_LIST_OBJECT,
|
|
}
|
|
|
|
@classmethod
|
|
def setUpDynamicTestCases(cls):
|
|
for le in cls.envs.keys():
|
|
for lm in cls.modes.keys():
|
|
for l1 in cls.perms.keys():
|
|
for l2 in cls.perms.keys():
|
|
for l3 in cls.perms.keys():
|
|
tname = "%s_%s_%s_%s_%s" % (le, lm, l1, l2, l3)
|
|
ve = cls.envs[le]
|
|
vm = cls.modes[lm]
|
|
v1 = cls.perms[l1]
|
|
v2 = cls.perms[l2]
|
|
v3 = cls.perms[l3]
|
|
targs = (tname, ve, vm, v1, v2, v3)
|
|
cls.generate_dynamic_test("test_visibility",
|
|
tname, *targs)
|
|
return
|
|
|
|
def setUp(self):
|
|
super(AclVisibiltyTests, self).setUp()
|
|
|
|
# Get the old "dSHeuristics" if it was set
|
|
self.dsheuristics = self.ldb_admin.get_dsheuristics()
|
|
# Reset the "dSHeuristics" as they were before
|
|
self.addCleanup(self.ldb_admin.set_dsheuristics, self.dsheuristics)
|
|
|
|
# Domain Admins and SYSTEM get full access
|
|
self.sddl_dacl = "D:PAI(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
|
|
self.set_dacl_control = ["sd_flags:1:%d" % security.SECINFO_DACL]
|
|
|
|
self.level_idxs = [ 1, 2, 3, 4 ]
|
|
self.oul1 = "OU=acl_visibility_oul1"
|
|
self.oul1_dn_str = "%s,%s" % (self.oul1, self.base_dn)
|
|
self.oul2 = "OU=oul2,%s" % self.oul1
|
|
self.oul2_dn_str = "%s,%s" % (self.oul2, self.base_dn)
|
|
self.oul3 = "OU=oul3,%s" % self.oul2
|
|
self.oul3_dn_str = "%s,%s" % (self.oul3, self.base_dn)
|
|
self.user_name = "acl_visibility_user"
|
|
self.user_dn_str = "CN=%s,%s" % (self.user_name, self.oul3_dn_str)
|
|
delete_force(self.ldb_admin, self.user_dn_str)
|
|
delete_force(self.ldb_admin, self.oul3_dn_str)
|
|
delete_force(self.ldb_admin, self.oul2_dn_str)
|
|
delete_force(self.ldb_admin, self.oul1_dn_str)
|
|
self.ldb_admin.create_ou(self.oul1_dn_str)
|
|
self.sd_utils.modify_sd_on_dn(self.oul1_dn_str,
|
|
self.sddl_dacl,
|
|
controls=self.set_dacl_control)
|
|
self.ldb_admin.create_ou(self.oul2_dn_str)
|
|
self.sd_utils.modify_sd_on_dn(self.oul2_dn_str,
|
|
self.sddl_dacl,
|
|
controls=self.set_dacl_control)
|
|
self.ldb_admin.create_ou(self.oul3_dn_str)
|
|
self.sd_utils.modify_sd_on_dn(self.oul3_dn_str,
|
|
self.sddl_dacl,
|
|
controls=self.set_dacl_control)
|
|
|
|
self.ldb_admin.newuser(self.user_name, self.user_pass, userou=self.oul3)
|
|
self.user_sid = self.sd_utils.get_object_sid(self.user_dn_str)
|
|
self.ldb_user = self.get_ldb_connection(self.user_name, self.user_pass)
|
|
|
|
def tearDown(self):
|
|
super(AclVisibiltyTests, self).tearDown()
|
|
delete_force(self.ldb_admin, self.user_dn_str)
|
|
delete_force(self.ldb_admin, self.oul3_dn_str)
|
|
delete_force(self.ldb_admin, self.oul2_dn_str)
|
|
delete_force(self.ldb_admin, self.oul1_dn_str)
|
|
|
|
del self.ldb_user
|
|
|
|
def _test_visibility_with_args(self,
|
|
tname,
|
|
fDoListObject,
|
|
modeDeny,
|
|
l1_allow,
|
|
l2_allow,
|
|
l3_allow):
|
|
l1_deny = 0
|
|
l2_deny = 0
|
|
l3_deny = 0
|
|
if modeDeny:
|
|
l1_deny = ~l1_allow
|
|
l2_deny = ~l2_allow
|
|
l3_deny = ~l3_allow
|
|
print("Testing: fDoListObject=%s, modeDeny=%s, l1_allow=0x%02x, l2_allow=0x%02x, l3_allow=0x%02x)" % (
|
|
fDoListObject, modeDeny, l1_allow, l2_allow, l3_allow))
|
|
if fDoListObject:
|
|
self.ldb_admin.set_dsheuristics("001")
|
|
else:
|
|
self.ldb_admin.set_dsheuristics("000")
|
|
|
|
def _generate_dacl(allow, deny):
|
|
dacl = self.sddl_dacl
|
|
drights = ""
|
|
if deny & security.SEC_ADS_LIST:
|
|
drights += "LC"
|
|
if deny & security.SEC_ADS_LIST_OBJECT:
|
|
drights += "LO"
|
|
if len(drights) > 0:
|
|
dacl += "(D;;%s;;;%s)" % (drights, self.user_sid)
|
|
arights = ""
|
|
if allow & security.SEC_ADS_LIST:
|
|
arights += "LC"
|
|
if allow & security.SEC_ADS_LIST_OBJECT:
|
|
arights += "LO"
|
|
if len(arights) > 0:
|
|
dacl += "(A;;%s;;;%s)" % (arights, self.user_sid)
|
|
print("dacl: %s" % dacl)
|
|
return dacl
|
|
|
|
l1_dacl = _generate_dacl(l1_allow, l1_deny)
|
|
l2_dacl = _generate_dacl(l2_allow, l2_deny)
|
|
l3_dacl = _generate_dacl(l3_allow, l3_deny)
|
|
self.sd_utils.modify_sd_on_dn(self.oul1_dn_str,
|
|
l1_dacl,
|
|
controls=self.set_dacl_control)
|
|
self.sd_utils.modify_sd_on_dn(self.oul2_dn_str,
|
|
l2_dacl,
|
|
controls=self.set_dacl_control)
|
|
self.sd_utils.modify_sd_on_dn(self.oul3_dn_str,
|
|
l3_dacl,
|
|
controls=self.set_dacl_control)
|
|
|
|
def _generate_levels(_l1_allow,
|
|
_l1_deny,
|
|
_l2_allow,
|
|
_l2_deny,
|
|
_l3_allow,
|
|
_l3_deny):
|
|
_l0_allow = security.SEC_ADS_LIST | security.SEC_ADS_LIST_OBJECT | security.SEC_ADS_READ_PROP
|
|
_l0_deny = 0
|
|
_l4_allow = security.SEC_ADS_LIST | security.SEC_ADS_LIST_OBJECT | security.SEC_ADS_READ_PROP
|
|
_l4_deny = 0
|
|
_levels = [{
|
|
"dn": str(self.base_dn),
|
|
"allow": _l0_allow,
|
|
"deny": _l0_deny,
|
|
},{
|
|
"dn": str(self.oul1_dn_str),
|
|
"allow": _l1_allow,
|
|
"deny": _l1_deny,
|
|
},{
|
|
"dn": str(self.oul2_dn_str),
|
|
"allow": _l2_allow,
|
|
"deny": _l2_deny,
|
|
},{
|
|
"dn": str(self.oul3_dn_str),
|
|
"allow": _l3_allow,
|
|
"deny": _l3_deny,
|
|
},{
|
|
"dn": str(self.user_dn_str),
|
|
"allow": _l4_allow,
|
|
"deny": _l4_deny,
|
|
}]
|
|
return _levels
|
|
|
|
def _generate_admin_levels():
|
|
_l1_allow = security.SEC_ADS_LIST | security.SEC_ADS_READ_PROP
|
|
_l1_deny = 0
|
|
_l2_allow = security.SEC_ADS_LIST | security.SEC_ADS_READ_PROP
|
|
_l2_deny = 0
|
|
_l3_allow = security.SEC_ADS_LIST | security.SEC_ADS_READ_PROP
|
|
_l3_deny = 0
|
|
return _generate_levels(_l1_allow, _l1_deny,
|
|
_l2_allow, _l2_deny,
|
|
_l3_allow, _l3_deny)
|
|
|
|
def _generate_user_levels():
|
|
return _generate_levels(l1_allow, l1_deny,
|
|
l2_allow, l2_deny,
|
|
l3_allow, l3_deny)
|
|
|
|
admin_levels = _generate_admin_levels()
|
|
user_levels = _generate_user_levels()
|
|
|
|
def _msg_require_name(msg, idx, e):
|
|
self.assertIn("name", msg)
|
|
self.assertEqual(len(msg["name"]), 1)
|
|
|
|
def _msg_no_name(msg, idx, e):
|
|
self.assertNotIn("name", msg)
|
|
|
|
def _has_right(allow, deny, bit):
|
|
if allow & bit:
|
|
if not (deny & bit):
|
|
return True
|
|
return False
|
|
|
|
def _is_visible(p_allow, p_deny, o_allow, o_deny):
|
|
plc = _has_right(p_allow, p_deny, security.SEC_ADS_LIST)
|
|
if plc:
|
|
return True
|
|
if not fDoListObject:
|
|
return False
|
|
plo = _has_right(p_allow, p_deny, security.SEC_ADS_LIST_OBJECT)
|
|
if not plo:
|
|
return False
|
|
olo = _has_right(o_allow, o_deny, security.SEC_ADS_LIST_OBJECT)
|
|
if not olo:
|
|
return False
|
|
return True
|
|
|
|
def _generate_expected(scope, base_level, levels):
|
|
expected = {}
|
|
|
|
p = levels[base_level-1]
|
|
o = levels[base_level]
|
|
base_visible = _is_visible(p["allow"], p["deny"],
|
|
o["allow"], o["deny"])
|
|
|
|
if scope == SCOPE_BASE:
|
|
lmin = base_level
|
|
lmax = base_level
|
|
elif scope == SCOPE_ONELEVEL:
|
|
lmin = base_level+1
|
|
lmax = base_level+1
|
|
else:
|
|
lmin = base_level
|
|
lmax = len(levels)
|
|
|
|
next_idx = 0
|
|
for li in self.level_idxs:
|
|
if li < lmin:
|
|
continue
|
|
if li > lmax:
|
|
break
|
|
p = levels[li-1]
|
|
o = levels[li]
|
|
visible = _is_visible(p["allow"], p["deny"],
|
|
o["allow"], o["deny"])
|
|
if not visible:
|
|
continue
|
|
read = _has_right(o["allow"], o["deny"], security.SEC_ADS_READ_PROP)
|
|
if read:
|
|
check_msg_fn = _msg_require_name
|
|
else:
|
|
check_msg_fn = _msg_no_name
|
|
expected[o["dn"]] = {
|
|
"idx": next_idx,
|
|
"check_msg_fn": check_msg_fn,
|
|
}
|
|
next_idx += 1
|
|
|
|
if len(expected) == 0 and not base_visible:
|
|
# This means we're expecting NO_SUCH_OBJECT
|
|
return None
|
|
return expected
|
|
|
|
def _verify_result_array(results,
|
|
description,
|
|
expected):
|
|
print("%s Results: %d" % (description, len(results)))
|
|
for msg in results:
|
|
print("%s" % msg)
|
|
self.assertIsNotNone(expected)
|
|
print("%s Expected: %d" % (description, len(expected)))
|
|
for e in expected:
|
|
print("%s" % e)
|
|
self.assertEqual(len(results), len(expected))
|
|
idx = 0
|
|
found = {}
|
|
for msg in results:
|
|
dn_str = str(msg.dn)
|
|
self.assertIn(dn_str, expected)
|
|
self.assertNotIn(dn_str, found)
|
|
found[dn_str] = idx
|
|
e = expected[dn_str]
|
|
if self.strict_checking:
|
|
self.assertEqual(idx, int(e["idx"]))
|
|
if "check_msg_fn" in e:
|
|
check_msg_fn = e["check_msg_fn"]
|
|
check_msg_fn(msg, idx, e)
|
|
idx += 1
|
|
|
|
return
|
|
|
|
for li in self.level_idxs:
|
|
base_dn = admin_levels[li]["dn"]
|
|
for scope in [SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE]:
|
|
print("\nTesting SCOPE[%d] %s" % (scope, base_dn))
|
|
admin_expected = _generate_expected(scope, li, admin_levels)
|
|
admin_res = self.ldb_admin.search(base_dn, scope=scope, attrs=["name"])
|
|
_verify_result_array(admin_res, "Admin", admin_expected)
|
|
|
|
user_expected = _generate_expected(scope, li, user_levels)
|
|
try:
|
|
user_res = self.ldb_user.search(base_dn, scope=scope, attrs=["name"])
|
|
except LdbError as e:
|
|
(num, _) = e.args
|
|
if user_expected is None:
|
|
self.assertEqual(num, ERR_NO_SUCH_OBJECT)
|
|
print("User: NO_SUCH_OBJECT")
|
|
continue
|
|
self.fail(e)
|
|
_verify_result_array(user_res, "User", user_expected)
|
|
|
|
# Important unit running information
|
|
|
|
ldb = SamDB(ldaphost, credentials=creds, session_info=system_session(lp), lp=lp)
|
|
|
|
TestProgram(module=__name__, opts=subunitopts)
|