samba.git/libcli/security, branch talloc-2.4.2

libcli/security: remove PRIMARY_{USER,GROUP}_SID_INDEX defines from security.h

2024-01-09T10:21:34+00:00

These and more are also defined in security_token.h, which is later included
from security.h anyway.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Günther Deschner 
Reviewed-by: Andreas Schneider

libcli/security: sddl conditional ACE: write -0 when asked

2023-12-21T23:48:46+00:00

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65122

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: rearrange conditional ACE sddl_write_int

2023-12-21T23:48:46+00:00

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65122

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: tests for signed zeros in sddl condtional ACEs

2023-12-21T23:48:46+00:00

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65122

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: allow SDDL conditional ACE round-trip for -00 and -0x0

2023-12-14T03:31:37+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: allow round-trip for conditional ACE hex integers

2023-12-14T03:31:37+00:00

As with the previous commit, though not addressing the particular fuzz
case, zero hex numbers need to be explicitly written as "0x0", or the
round-trip will fail.

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62929

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: allow round-trip for conditional ACE octal integers

2023-12-14T03:31:37+00:00

The string "00" will decode into an integer tagged as octal, but
`snprintf("%#oll")` will write the string "0", which would decode as
decimal, so the in the SDDL1->SD1->SDDL2->SD2 round trip, SD1 would
not be the same as SD2.

The effect is really only relevant to SDDL, which wants to remember
what base the numbers were presented in, though the fuzzers and tests
don't directly compare SDDL, which can have extra spaces and so forth.

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62929

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: tests for conditional ACE integer base persistence

2023-12-14T03:31:37+00:00

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62929

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: fix tests for SDDL conditional ACE round-trip

2023-12-14T03:31:37+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: clarify tests for SDDL round trips

2023-12-14T03:31:37+00:00

The `failed = failed || ok` did the same thing, obscurely.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett