samba.git/libcli/security/tests, branch talloc-2.4.2

libcli/security: tests for signed zeros in sddl condtional ACEs

2023-12-21T23:48:46+00:00

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65122

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: tests for conditional ACE integer base persistence

2023-12-14T03:31:37+00:00

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62929

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: fix tests for SDDL conditional ACE round-trip

2023-12-14T03:31:37+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: clarify tests for SDDL round trips

2023-12-14T03:31:37+00:00

The `failed = failed || ok` did the same thing, obscurely.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: add test_claims_conversion

2023-11-27T22:37:32+00:00

These are unit tests for converting wire claims into sorted claims v1
structures.

These are based from packets derived from the krb5.conditional_ace
tests, and currently don't test more than they do, but they work about
a hundred thousand times quicker.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: test_run_conditional_ace tests more comparisons

2023-11-27T22:37:32+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: test_run_conditional_ace can set debug levels

2023-11-27T22:37:32+00:00

No -d, just `bin/test_run_conditional_ace 3`.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security/tests: gunzip the oversized-acls test vectors

2023-11-27T02:10:12+00:00

These are just as readable with `less` as they were with `zless`.

This file has been slightly manually edited to add line-breaks. There
is not an easy setting in Python's json module to get good formatting.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Mon Nov 27 02:10:12 UTC 2023 on atb-devel-224

libcli/security/tests: remove duplicate TX-integer tests from oversized-ACLs

2023-11-27T01:12:40+00:00

We had two sets of test vectors (Windows ground-truth for SDDL
compilation) that got mixed up.

The "oversized ACLs" set is ACLs that contain repeated ACEs, like
"D:P(D;;;;;MP)(D;;;;;MP)" -- Windows will assign a size to the ACL
that is greater than the sum of the ACEs, while Samba will not (in
part because we don't actually store a size for the ACL, instead
calculating it on the fly from the size of the ACEs).

The "TX integers" set is for resource attribute ACEs with octet-string
data that contains pure integers (lacking '#' characters) in their
SDDL, like «(RA;;;;;WD;("bar",TX,0x0,0077,00,0077,00))». We used to
think that was weird, and that RA-TX ACEs should contain octet-strings
in the conditional ACE style. But now we have realised it's not weird,
it's normal, and we have fixed our handling of these ACEs.

As a result of this mix-up, some of the tests labelled as "oversized
ACLs" started passing when we fixed the TX integer problem, and that
was confusing. All of the removed tests are already on the TX integer
set -- the removed ones were duplicates.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security/test_sddl_conditional_ace: adjust RA octet parse tests

2023-11-27T01:12:40+00:00

We are going to parse octet strings like Windows (as opposed to like
Windows docs), so the tests need changing.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett