samba.git/libcli/security/conditional_ace.c, branch talloc-2.4.2

libcli/security: don't allow conditional ACE SIDs to have trailing bytes

2023-12-14T03:31:37+00:00

They should be tightly packed, allowing conditional ACEs to
round-trip.

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64197

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: note suboptimality of conditional ACE Contains operators

2023-11-27T23:38:13+00:00

The Contains and Any_of operators could use a sorted comparison like
compare_composites_via_sort(), rather than O(n²) nested loops. But
that would involve amount of quite fiddly work that I am not starting
on now.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Mon Nov 27 23:38:13 UTC 2023 on atb-devel-224

libcli/security: comparability check: claim members are of one type

2023-11-27T22:37:32+00:00

We know from the way claims are defined, and from the code that checks
sortedness and sets the flag.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: shift comparability check to shortcut exits

2023-11-27T22:37:32+00:00

The ordinary comparison path, using the sorted arrays, already implicitly
checks for comparability. We only need this when we're leaving early.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: add shortcuts for conditional ACE compare

2023-11-27T22:37:32+00:00

If the number of members does not match in certain ways we can
say the sets are not equal without comparing the members.

We first need to check for comparability, though, so that we can return
an error if things aren't comparable.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: improve conditional ACE composite comparison

2023-11-27T22:37:32+00:00

We had the comparison method wrong. Composites are compared as sets or
flabby sets, depending on their origin. Until now we compared them as
something a bit like sets, but not quite, in a maximally inefficient way.

Claims are always sets, and the left hand side is always a claim, but
literal composites on the right hand side can be multi-sets
(containing duplicate values). When it comes to comparison, composites
are reduced down to sets. To do the comparison we sort each side and
compare in order.

The fact that either side might ask for case-sensitive comparison (if
it is a claim) is an interesting complication.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

lib/security:CA: tokens_are_comparable() accepts NULL operator

2023-11-27T22:37:32+00:00

In some circumstances we are going to know general comparability
without having an operator around to use.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: CA: tokens_are_comparable() considers the obvious

2023-11-27T22:37:32+00:00

Existing callers already make this check, but we are soon going to use
it in contexts that don't.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: initialise conditional ACE token flags

2023-11-27T01:12:40+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: Fix code spelling

2023-10-25T22:23:37+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett