samba.git/libcli/security/conditional_ace.c, branch master

libcli: Align an integer type

2024-12-17T12:30:30+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Pavel Filipenský

libcli: Remove the "mem_ctx" argument from pull_integer()

2024-12-17T12:30:30+00:00

Not needed anymore

Signed-off-by: Volker Lendecke 
Reviewed-by: Pavel Filipenský

libcli: Simplify pull_integer()

2024-12-17T12:30:30+00:00

Use ndr_pull_struct_blob_noalloc, we don't need talloc here.

Signed-off-by: Volker Lendecke 
Reviewed-by: Pavel Filipenský

libsecurity: Simplify struct ace_condition_script

2024-09-06T14:23:58+00:00

We only need the stack temporarily, no reason to put it in the struct

Signed-off-by: Volker Lendecke 
Douglas Bagnall 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Fri Sep  6 14:23:58 UTC 2024 on atb-devel-224

libcli/security: don't allow conditional ACE SIDs to have trailing bytes

2023-12-14T03:31:37+00:00

They should be tightly packed, allowing conditional ACEs to
round-trip.

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64197

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: note suboptimality of conditional ACE Contains operators

2023-11-27T23:38:13+00:00

The Contains and Any_of operators could use a sorted comparison like
compare_composites_via_sort(), rather than O(n²) nested loops. But
that would involve amount of quite fiddly work that I am not starting
on now.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Mon Nov 27 23:38:13 UTC 2023 on atb-devel-224

libcli/security: comparability check: claim members are of one type

2023-11-27T22:37:32+00:00

We know from the way claims are defined, and from the code that checks
sortedness and sets the flag.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: shift comparability check to shortcut exits

2023-11-27T22:37:32+00:00

The ordinary comparison path, using the sorted arrays, already implicitly
checks for comparability. We only need this when we're leaving early.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: add shortcuts for conditional ACE compare

2023-11-27T22:37:32+00:00

If the number of members does not match in certain ways we can
say the sets are not equal without comparing the members.

We first need to check for comparability, though, so that we can return
an error if things aren't comparable.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: improve conditional ACE composite comparison

2023-11-27T22:37:32+00:00

We had the comparison method wrong. Composites are compared as sets or
flabby sets, depending on their origin. Until now we compared them as
something a bit like sets, but not quite, in a maximally inefficient way.

Claims are always sets, and the left hand side is always a claim, but
literal composites on the right hand side can be multi-sets
(containing duplicate values). When it comes to comparison, composites
are reduced down to sets. To do the comparison we sort each side and
compare in order.

The fact that either side might ask for case-sensitive comparison (if
it is a claim) is an interesting complication.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett